Hello,
I have a opnsense 26.7 running. I have several firewall rules, and I just did a quick nmap scan from an external computer that is not connected to my LAN, to check if the opnsense is behaviouring correctly.
I used the below command, and I discover something that I am not sure but I don't like it:
# nmap -Pn -vv <MY WAN IP OF THE OPNSENSE BOX>
Starting Nmap 7.92 ( https://nmap.org ) at 2026-07-23 13:55 CEST
Initiating Parallel DNS resolution of 1 host. at 13:55
Completed Parallel DNS resolution of 1 host. at 13:55, 0.00s elapsed
Initiating Connect Scan at 13:55
Scanning <redacted> [1000 ports]
Discovered open port 22/tcp
Discovered open port 443/tcp
Discovered open port 80/tcp
Discovered open port 2000/tcp
Discovered open port 5060/tcp
Completed Connect Scan at 13:55, 4.52s elapsed (1000 total ports)
Nmap scan report
Host is up, received user-set (0.0076s latency).
Scanned at 2026-07-23 13:55:23 CEST for 5s
Not shown: 994 filtered tcp ports (no-response)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
113/tcp closed ident conn-refused
443/tcp open https syn-ack
2000/tcp open cisco-sccp syn-ack
5060/tcp open sip syn-ack
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 4.57 seconds
This is quite interesting. So port 22/tcp is clear, as I have a Git server running, and for the SSH I have opened port 22 and forwarded it. So this is expected.
Ports 80/tcp and 443/tcp I expect as well, as I am running Caddy as reverse proxy for some internal web servers. So these are also fine!
However, what I 100% don't understand is the remaining ports.
a) why is there 113/tcp "closed" with "conn-refused" ? I am not using this port, nowhere, and inside the opnsense firewall rules, I cannot see one single rule that uses this port. So why then is it even reported?
b) ports 2000/tcp and 5060/tcp are reported open. However, I have, inside my opnsense firewall rules table, also not found one single rule that references to these ports. Should they not be blocked automatically? why are these ports open? it is super strange. I see that these can be used by certain VoIP services, but I did not enable any such services on my opnsense, not at all. I have not even installed any such plugins, nor have I configured them.
So I don't really get why these ports are open, but it bothers me a lot, that three ports that I never touched are reported in a scan. How can this be, and should/can I fix it?
Edit:
I should mention, this is on a FTTH connection, I use the ISP's modem in bridge mode, so I am wondering whether the modem could respond to these ports, but I doubt it.
Is anything listening on those ports?
sockstat -4 -6 -l | grep :2000
sockstat -4 -6 -l | grep :5060
Port 113 is often blocked by ISPs - there is good reason to do that. Try if you see any packets on that port by creating a logging rule for the port and see if it fires at all.
You can check by creating rules as well for the "open" ports in order to see if something in front of your connection catches these packets, be it the ISP or the bridge modem.
Other than that, you may have a PNP daemon installed which allows LAN devices to dynamically open ports to the outside and some VoIP or other device does this (And yes, port 5060 is for SIP).