Scanning my public IP address with Nmap finds TCP port 1720 open, is this a security concern?

Question

When scanning my public ip address with Nmap I found out that I have open port on 1720/TCP. According Nmap service on it is H.323/Q.931. Researching uses of this port also brings up Microsoft Netmeeting.

I did the scan from outside, not from my own network.

My router/modem is ZyXEL P-660HN-T1A, ADSL2+. The modem is in routing state and devices behind it are using NAT. Devices behind the modem are Windows 7 computer that was turned off during the scan and Linux server that is listening only on 22/SSH. On the settings of the modem port forwarding active only for the SSH port. As far as I can see from the settings, there is no remote management allowed from WAN.

So why does port 1720 appear open on Nmap scan? Is this some feature of the modem or could this mean some kind of security breach?

EDIT: I did the same from my home computer to my public IP. From this point of view the port 1720 is not open. Does that tell something?

EDIT2: From the settings I found out that UPnP was enable for LAN only. I don't have any VOIP services. I am not aware of my ISP managing my device. (They did not provide the device.)

EDIT3: Telneting my public ip and port 1720 from the outside connects:

Connected to <my ip>
Escape character is '^]'
<giving any input>
Connection closed by foreign host.

EDIT4: More scanning revealed that I also had port 7547open (Allegro RomPager according to Nmap). It even provided html page accessed from the internet.

Answer 1

I managed to solve this somewhat by port forwarding both of those open ports on my local network to non-existent ip and to port 9 (Discard Protocol).

This made the port 7547 closed. But the port 1720 still allows telnet connection from the outside world.

I still wonder if these is any way to get this port closed as well.

UPDATE: After dealing with Zyxel customer support it appears that there is no fix for this. Problem is probably caused bug in the firmware.

Answer 2

This port could be open for a few reasons. Do you have UPnP enabled on the router portion? If so, that means any capable device/computer can punch holes from your network to the outside world. This port is also left open by default by several ISPs so they can remote into the modem/router for maintenance and customer support. Port 1720 is also used by Voice Over IP. So if you have that service from your ISP, this could be the reason it is open as well.

You can attempt to telnet to the ip:port from an outside source and see if you can get an answer as to what device/protocol is listening (if any) on it as well.

Answer 3

This could be caused by the network you are performing the scan from. For example some routers seem to always intercept traffic on certain ports, even when the target device doesn't listen on that port. Some routers even answer to packets for ip addresses not assigned to any device, or for bogus addresses like private adresses or reserved addresses. You can try scanning other hosts to see if they also have port 1720 open. If all hosts that you scan have that port open, it's almost certainly caused by the network you scan from. You can also try scanning from another network.

Answer 4

Port 1720 h323.. In cell phones lately and possibly other diff devices are used by aligning the MS number recognition, the the three are other devices and three are other people, which opens a gateway down through the spinal canal and sometimes three are larger numbers, which are also radio frequency number recog. (upon three or more collaborate),that use either the police, the actual environment off of arpa thro phone calls(which they do next), or the frequency numbers will be so big it jumps the police and opens foreign ports,,,, through that it hosts into your device as part of an experiment to control the brain and or body of objects that either within the body or around you through your device and or body, using GPS and or conversion API crap... It's all illegal really but I guess someone took it upon themselves to not give a darn if we had previous injuries and or occurrences that prevent us from being able to participate, such as a split spinal chord from a 3D printed device. The courts are almost human trafficking for this knowingly or unknowingly out here in these carbon counties, but a mother is unable to keep up with her two kids for over five years because a free government phone cut off, isn't making these people look trialably worth rescuing either... One decade of this crap would kill any kid inner uteral.