Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Preface: I have never touched the firewall ports on this particular Verizon FiOS Actiontec ISR.

For fun, I went into the web admin panel of my home router and saw that firewall rules had been automatically added, with app names and sometimes version numbers corresponding to each rule:

firewall

Due to the specificity of these entries, it concerns me that any app running on the internal side of my network can open ports to the outside. Is this behavior normal? Why does it happen?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

Yes, it is normal, if you have UPnP enabled on the router. Applications behind the router/firewall can ask it to open and forward specific ports to an internal IP when needed (VoIP, P2P,...). It is done dynamically, and the ports are closed after some time.

You can probably check to see if UPnP is enabled on your router, and disable it, if you want to have static rules.

More on this on wikipedia

share|improve this answer

what you are probably seeing is the result of UPnP - Universal Plug and play doing it's thing.

To over simplify the process, the host on the inside sends a request to the UPnP enabled router to have a port automatically forwarded. A lot of times consumer grade equipment does things like this simply and easily, and then you go stick in a more advanced device that requires explicit configuration and people mistake this for things not working "properly". UPnP typically will have some kind of timeout where the rules expire after some time or after the host that requested the port forward goes offline the rule expires.

On the other hand, its entirely possible that your router has been compromised :)

share|improve this answer
    
I've heard of UPnP before, but never really looked into it. Doesn't this seem like a bad idea, especially if there's a rogue program that infiltrates the network? –  esqew Apr 29 '12 at 23:51
2  
Yes, absolutely, but it's a matter of convenience. In small offices and residential settings when little Johnny wants to have NAT type open for Xbox live or play a game with his buddies, this makes things groove. It has NO place in a business setting. –  SpacemanSpiff Apr 29 '12 at 23:52

Yes. There is a protocol to signal port opening requests to home routers/firewalls. It is called UPnp It is considered to be okay to let your firewall reconfigure itself according to these requests as it only accepts internal requests from you appliances of software running on your computer.

On the other hand if you think this is undesirable you can look for UPnP and disable it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.