public IP port exposed which is closed by NAT on router

Question

Level 1

0 points

public IP port exposed which is closed by NAT on router

Hi,

A server (IP address: privateIP) is connected to the internet using an Airport extreme router with NAT port mapping. Only port 80 and 443 are opened. This means that publicIP:80 --> privateIP:80, same for port 443.

How is it possible that there is an open UDP connection on port 32xx (in the airport logs) to a device on the private WiFi network? So, publicIP:32xx --> privateIP:32xx

Does this means that a connection from publicIP -> privateIP is blocked, but privateIP --> publicIP is opened (when this device does not have a firewall such as a mobile device for example). How can this be avoided?

Thanks in advance for your help!

Regards, Bart

Posted on Nov 26, 2013 11:54 AM

Reply

Answer 1

dkkdkdkdkdkk Author

Level 1

0 points

Nov 26, 2013 11:58 AM in response to dkkdkdkdkdkk

one addition: the log of the airport extreme mentions "Binding added for UDP, publicIP:32xx --> privateIP:32xx"

Reply

Answer 2

Nov 26, 2013 1:29 PM in response to dkkdkdkdkdkk

UDP doesn't have connections. It's a datagram service.

Ports in the UDP port 3200 to 3299 range are expected to be registered (list), but "squatting" on or even spoofing ports is possible, depending on what software is connected on the port.

Usual trigger for these paths through the firewall is some device behind the firewall that's been communicating remotely via that port.

You may have to more specifically identify the device on your local network, and determine what component is communicating with remote hosts on 32xx. Depending on the host, there are various ways to do that.

It's possible to exercise substantial control of network activites with mid-grade firewalls; something with a bit more capability and flexibility than an AirPort Extreme NAT-based firewall.

If you have untrusted devices connected on your local network, you might want a firewall that can provide multiple networks; a guest or DMZ network, for instance.

Reply

Answer 3

dkkdkdkdkdkk Author

Level 1

0 points

Nov 26, 2013 2:04 PM in response to MrHoffman

Thanks for the reply. Very helpful. The device on the network was an iOS device (iphone). The firewall of iOS cannot be controlled (if not jailbroken), so I don't understand how this can be avoided with a firewall because an App on the phone causes this (still finding out which App...).

The WiFi network runs off an Airport base station. MrHoffman, do you know how communication to port 32xx can be blocked? Do I need to place a server after the Airport base station with a firewall and block port 32xx? Or do you mean a hardware firewall?

Best regards, Bart

Reply

Answer 4

Nov 26, 2013 2:43 PM in response to dkkdkdkdkdkk

How to block an outbound UDP port? Get a more advanced firewall. Alas, the AirPort is fairly limited in its capabilities. (The only way I'm aware that an AirPort-class device can block a UDP port established by outbound NAT traffic is by adding a static forwarding rule that sends UDP port requests off into hyperspace; to what will need to be an unused port. You might also want to disable NAT Port Mapping Protocol or NAT-PMP, if that's been enabled.)

Or determine what's running on the iOS device, as you've mentioned you're researching.

Command line tools that can scan a target host for an open UDP port, or a range of UDP ports:

nc -zu 10.20.30.40 3200

nc -zu 10.20.30.40 3200-3299

nc -vvzu 10.20.30.40 3200-3299

Using netcat probably won't directly help you very much, though you might be able to brute-force cycle through applications to see what's in use, rebooting your phone as a way to avoid having to wait for any background apps to exit.

Reply

Answer 5

dkkdkdkdkdkk Author

Level 1

0 points

Nov 27, 2013 12:39 AM in response to MrHoffman

Thanks for the information. nc works very nice. I did the following:

1. Prepare server with IP 10.20.30.40 to block all UDP traffic with OS X firewall

2. nc -zu 10.20.30.40 3200 --> this reports that it can connect to the port

3. Firewall log on 10.20.30.40 shows "Deny UDP...." (traffic blocked)

This is mentioned by man nc:

CAVEATS

UDP port scans will always succeed (i.e. report the port as open), rendering the

-uz combination of flags relatively useless.

Is there a way to know if the UDP port is closed (and get it reported properly in nc) ?

The hyperspace trick is also described here if I understand you correctly: https://discussions.apple.com/thread/2408952 (I will try)

Could you advice a more advance firewall router (wired, gigabit) to replace the Airport Extreme? I was also thinking about this (to add a server running http://www.astlinux.org/). What do you think about this?

Reply

Answer 6

Nov 27, 2013 1:22 PM in response to dkkdkdkdkdkk

Yes; that thread is the hyperspace reference. Port mapping the connection into oblivion.

I usually use ZyXEL ZyWALL USG series devices, but those are definitely not entry-level devices suited for inexperienced network users; the UI is cogent and consistent, but the administrator is expected to already understand IP networking, DNS and related details.

Will take a look at nc; haven't run into that case. (I usually monitor this stuff at the level of the switch.)

Reply

Answer 7

dkkdkdkdkdkk Author

Level 1

0 points

Dec 17, 2013 11:32 AM in response to MrHoffman

I decided to purchase the Zywall in the end and it is setup nicely now! 🙂

Works great and you have much better control.

I am still struggling with DNS however. The DNS server is placed in the DMZ and is configured as split DNS for the internet. The internal network (LAN1) needs also this DNS server for internal DNS. This does not work. Do you know how to setup DNS with the Zywall? First DNS server is now the Zywall and the second DNS my DNS server in the DMZ. So, I guess I am asking how to setup split DNS with the Zywall.

Many thanks for your help in advance!

Reply

Answer 8

Dec 17, 2013 2:31 PM in response to dkkdkdkdkdkk

Either run DNS services for the DMZ at the ZyXEL ZyWALL USG using its integrated DNS server, or run DNS services on the OS X Server box.

Here's how to set up OS X Server DNS.

If you configure the USG for DNS, then aim the DNS server reference on the server at the USG.

I wouldn't run both the USG DNS server and the OS X Server DNS server here, though that's just extra work and duplicated effort and won't hurt anything.

If you do run DNS services in your DMZ, do not allow remote access into your DNS server through your USG. Do not map TCP or UDP port 53 through from the Internet.

Reply

Answer 9

dkkdkdkdkdkk Author

Level 1

0 points

Dec 20, 2013 11:39 AM in response to MrHoffman

Thanks very much. Problem solved. Used the DNS server of the ZyWall. Your site has a lot of useful information and a lot more than when I looked at it in the past. Nice!

Reply