Preface: I have never touched the firewall ports on this particular Verizon FiOS Actiontec ISR.
For fun, I went into the web admin panel of my home router and saw that firewall rules had been automatically added, with app names and sometimes version numbers corresponding to each rule:
Due to the specificity of these entries, it concerns me that any app running on the internal side of my network can open ports to the outside. Is this behavior normal? Why does it happen?
Yes, it is normal, if you have UPnP enabled on the router. Applications behind the router/firewall can ask it to open and forward specific ports to an internal IP when needed (VoIP, P2P,...). It is done dynamically, and the ports are closed after some time.
You can probably check to see if UPnP is enabled on your router, and disable it, if you want to have static rules.
More on this on wikipedia
what you are probably seeing is the result of UPnP - Universal Plug and play doing it's thing.
To over simplify the process, the host on the inside sends a request to the UPnP enabled router to have a port automatically forwarded. A lot of times consumer grade equipment does things like this simply and easily, and then you go stick in a more advanced device that requires explicit configuration and people mistake this for things not working "properly". UPnP typically will have some kind of timeout where the rules expire after some time or after the host that requested the port forward goes offline the rule expires.
On the other hand, its entirely possible that your router has been compromised :)
Yes. There is a protocol to signal port opening requests to home routers/firewalls. It is called UPnp It is considered to be okay to let your firewall reconfigure itself according to these requests as it only accepts internal requests from you appliances of software running on your computer.
On the other hand if you think this is undesirable you can look for UPnP and disable it.
