When scanning my public ip address with Nmap I found out that I have open port on 1720/TCP. According Nmap service on it is H.323/Q.931. Researching uses of this port also brings up Microsoft Netmeeting.

I did the scan from outside, not from my own network.

My router/modem is ZyXEL P-660HN-T1A, ADSL2+. The modem is in routing state and devices behind it are using NAT. Devices behind the modem are Windows 7 computer that was turned off during the scan and Linux server that is listening only on 22/SSH. On the settings of the modem port forwarding active only for the SSH port. As far as I can see from the settings, there is no remote management allowed from WAN.

So why does port 1720 appear open on Nmap scan? Is this some feature of the modem or could this mean some kind of security breach?

EDIT: I did the same from my home computer to my public IP. From this point of view the port 1720 is not open. Does that tell something?

EDIT2: From the settings I found out that UPnP was enable for LAN only. I don't have any VOIP services. I am not aware of my ISP managing my device. (They did not provide the device.)

EDIT3: Telneting my public ip and port 1720 from the outside connects:

Connected to <my ip>
Escape character is '^]'
<giving any input>
Connection closed by foreign host.

EDIT4: More scanning revealed that I also had port 7547open (Allegro RomPager according to Nmap). It even provided html page accessed from the internet.

4 Answers 4


I managed to solve this somewhat by port forwarding both of those open ports on my local network to non-existent ip and to port 9 (Discard Protocol).

This made the port 7547 closed. But the port 1720 still allows telnet connection from the outside world.

I still wonder if these is any way to get this port closed as well.

UPDATE: After dealing with Zyxel customer support it appears that there is no fix for this. Problem is probably caused bug in the firmware.


This port could be open for a few reasons. Do you have UPnP enabled on the router portion? If so, that means any capable device/computer can punch holes from your network to the outside world. This port is also left open by default by several ISPs so they can remote into the modem/router for maintenance and customer support. Port 1720 is also used by Voice Over IP. So if you have that service from your ISP, this could be the reason it is open as well.

You can attempt to telnet to the ip:port from an outside source and see if you can get an answer as to what device/protocol is listening (if any) on it as well.

  • From the settings I found out that UPnP was enable for LAN only. I don't have any VOIP services. I am not aware of my ISP managing my device. (They did not provide the device.) Aug 11, 2015 at 14:47
  • I was running into a similar issue so I scanned some very common sites (google, fb, twitter, etc) for that one port in particular to get a baseline. For some, I saw nmap return that they were open on 1720, for others, that the port was filtered. Would you expect to see this behavior if the issue is what you described above? I know this is an old question, but I haven't found much else online about this.
    – jaredad7
    Jun 23, 2021 at 17:10

This could be caused by the network you are performing the scan from. For example some routers seem to always intercept traffic on certain ports, even when the target device doesn't listen on that port. Some routers even answer to packets for ip addresses not assigned to any device, or for bogus addresses like private adresses or reserved addresses. You can try scanning other hosts to see if they also have port 1720 open. If all hosts that you scan have that port open, it's almost certainly caused by the network you scan from. You can also try scanning from another network.


Port 1720 h323.. In cell phones lately and possibly other diff devices are used by aligning the MS number recognition, the the three are other devices and three are other people, which opens a gateway down through the spinal canal and sometimes three are larger numbers, which are also radio frequency number recog. (upon three or more collaborate),that use either the police, the actual environment off of arpa thro phone calls(which they do next), or the frequency numbers will be so big it jumps the police and opens foreign ports,,,, through that it hosts into your device as part of an experiment to control the brain and or body of objects that either within the body or around you through your device and or body, using GPS and or conversion API crap... It's all illegal really but I guess someone took it upon themselves to not give a darn if we had previous injuries and or occurrences that prevent us from being able to participate, such as a split spinal chord from a 3D printed device. The courts are almost human trafficking for this knowingly or unknowingly out here in these carbon counties, but a mother is unable to keep up with her two kids for over five years because a free government phone cut off, isn't making these people look trialably worth rescuing either... One decade of this crap would kill any kid inner uteral.

  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Sep 8, 2022 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .