[solved] Port 8081 seen on WAN by Portscan

[ruggerio]

Hi,

when i issue a portscan to my external IP-Adress, i see, that port 8081 is open.

I already issued a Rule on WAN-Port for incoming traffic, but the port is still shown as open. How can i Close this?

Roger

[elektroinside]

Are you scanning from the internet or locally from your LAN?

[ruggerio]

Scan comes from internet.

[elektroinside]

Do you have a rule which allows traffic on that port or forwards the port to something else? You also need to have a service which listens on that port (accepts connections), what is that service? Also, what kind of port are we talking about, TCP or UDP?

If you have no rules allowing/forwarding traffic on that port, try scanning with something else, there's a chance that the scanner is not accurate.

I had my share of problems with OPNsense over time, but security wasn't one of them, never read about the firewall not doing its job, so I'm almost certain it's not OPNsense related :-)

[ruggerio]

Thx!

No rule, no forwarding, but upnp activated. There is a Server listening on Port 8081, which seems to affect also the WAN-Port.

Will try to exclude this.

Roger

[elektroinside]

There you go, I'm fairly certain that's the reason. With UPnP disabled, the fw should not open any ports.
As a personal rule, I never use UPnP :)

You're very welcome.

[ruggerio]

Yeah, in fact it is upnp.

I Changed now the rule on the Interface, in which the devices hang and block outgoing traffic (instead of blocking it on wan-port).

This seems to do the trick, even with upnp enabled.

Roger

[elektroinside]

Great, good work!

[ruggerio]

*sigh* it went back, but now its definitively solved.

I just configured upnp to "deny all" and allowed 2 devices, but not the one with Port 8081.

So, now its closed.

Roger

[elektroinside]

If you feel your issue is fixed, you can prepend [Solved] to the title of your first post :)