Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using a Netgear wireless router, and its internal firewall is good. Testing by using Gibson Research "Shields Up" indicates all ports invisible. However, when I use a VPN service to connect to the internet, I see that port 88 is left open.

What are the risks of that port, and how can I close it? I've tried logging onto my router, but it offers no firewall configuration.

share|improve this question
Port 88 is usually kerberos (a network auth protocol) . . you need to have inbound connections for UDP for it to work. – ernie May 6 '14 at 0:38
TCP or UDP? a nat firewall can't deal atomically with UDP transmissions, because it cannot trace the connection attributes like syn/ack values to determine what part of what communication the segment consists of. as a result it relies on timers and other mechanisms to make inferences as to whether a UDP segment is solicited or not. if you were to send udp traffic out just before scanning, the port may appear open, because the NAT believes the probes may be part of a solicited stream. if you had not established a udp session on that port recently, it would probably appear stealthed. – Frank Thomas May 6 '14 at 1:04
as for the consequences of having the port accessible, you have to rely on the resilience of the process operating on the port to filter out bad input, and fail safely if bad input is received. The internals of NAT are not generally configurable beyond port forwarding, so probably not much you can do to disable it. if you did, DNS on your network would probably fail if you messed with UDP evaluation rules. NAT rules and firewall rules are different, so even if you could configure the firewall, it probably wouldn't help unless the udp stream is always from the same source. – Frank Thomas May 6 '14 at 1:12

I am going to guess when you are connected to VPN that is an outgoing port, not incoming. When you connect, your router shows that port being open because some port needs to be open in order for VPN to work.

I would not stress on this port being open while you are connected to VPN. Are you blocking ICMP packets on the WAN (internet port)? If so, that will stop 99.9% of anyone scanning IP addresses from even thinking about scanning you to see if port 88 is open, because scanners generally ping an address to see if it responds. If it does not, the scanner moves on and does not continue to try to port scan unless an attacker happens to know that there is a computer at that IP address. You would have to be a very specifically targeted person at this point. The chances of that are very very very small (unless you make a point to piss off people who know a lot about networking). Even if an attacker did know that a computer was at a IP address but blocking ICMP, and they knew port 88 was open, they would have to be able to exploit some vulnerability in the protocol/service to attack you.

share|improve this answer
Shields Up is an external scan . . . that means port 88 is an open, incoming port when connected to the VPN . . . – ernie May 6 '14 at 0:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .