I checked my home network router and this device has open ports facing the internet, what should I do?
It can be a security risk to have unwarranted open ports. So I ran nmap 192.168.0.1 to investigate if I had open ports on my home network, it turns out, I do:
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
5431/tcp open park-agent
49163/tcp open unknown
This concerned me. However, upon further reading, I have discovered that running nmap from my home desktop does not obtain the actual open ports, but rather ports which are accessible from my desktop on the local network side; I'm interested in ports open to the Internet at large.
Therefore, I tethered my desktop to my phone Wi-Fi Hotspot and ran nmap again, this time I am outside of my local network, i.e. I am not connected to my home router provided by my ISP but rather connected to the Internet through my phone service provider. I ran nmap again, this time using the external IP Address of my home network. The output is as follows:
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
113/tcp closed ident
443/tcp open https
1935/tcp open rtmp
8080/tcp open http-proxy
There are still numerous open ports, which I was not expecting, as I am not running any servers and simply use my home network for Internet browsing. I do not think I should have any open ports. Why are these ports open to begin with? And should I be concerned/close to them?
You are right if this device has open ports facing the internet, it's a security issue, and there are already documented cases of massive hacks done thru home routers, for example in Brazil:
https://nakedsecurity.sophos.com/2012/10/01/hacked-routers-brazil-vb2012/ Most routers will let you do DMZ, port-forwarding, etc. However such ports should be disabled/closed/firewalled by default. The very least that your ISP should have done is ensure that ports like the ones you have enlisted are accessible (open) only from their corporate IP's if they are using it to collect some usage data, etc... They could have done it at their core firewalls/routers... My suggestion is to report a security issue to your ISP, and monitor if they have corrected it, if not, then seek for another ISP, but ask them for the mentioned security issue. Or try to flash your router with software like DD-WRT.