Port 8080

Port 8080 is the traditional port used for web proxy servers (squid being the exception, as it defaults to 3128). It's common for firewalls to leave this port open for outgoing if you allow web access. Also, some routers will act as a proxy for you on this port, which can be a good thing.

For incoming, it can and should normally be closed except for for return traffic (unless you run a proxy server on the inside that should be open to the outside).

Regards,

Port scan shows it open on his router but not mine - two different routers is why. It should show as blocked according to *every* port scan site we've been to. Only IDENT 113 should show as Closed and maybe HTTP 80 as Closed also, no ports should show as Open. When he disconnects the router and uses just the cable modem along with Sygate firewall on his computer it shows all tested ports blocked.

I'll send him what you posted though and he can test it himself. But we don't even allow Telnet services to run on our computers so I doubt he will. I think he is just going to buy a better router at this point. Thx anyway.

Maybe, and at first I did tell him to check with his ISP if he is going through a proxy server but he isn't. Even if it is a proxy in the router it should still show as closed. When I run a port scan in a web browser through my router it still shows port 80 as closed and that's using three different port scan sites. He has a remote management console in his router and I read that sometimes port 8080 is used for remote management. But he has that disabled. He wants Port 8080 blocked as it is on my router (not closed but blocked ie,stealth) so I think he is going to dump the Pine and get a D-Link or Lynksys. There is no way it should show as open if it had a decent firewall built in. He's still protected well as he uses Sygate PF on his PC too but it's just the little details that get to ya in the end, eh?. After making the post here I was doing a port scan at grc.com and he has some info on routers and actually said some routers don't have very good firewalls and leave a port or two open when they shouldn't. I will tell him what you said though.Thx.

How do you know, it is "open"? What is "open" for you?

Try connecting to port 8080. Take your browser and point it to http://192.168.1.1:8080/ or try connecting with telnet like

telnet 192.168.1.1 8080

If you get a response either way there is something running on port

If the web browser cannot connect and telnet is basically immediately returns with an error message, then the router is perfectly safe. As long as there is nothing listening on a port the port is safe. A port is "open" once a server is listening which has potential dangers if the server is vulnerable or has bugs.

Gerald

I was able to connect to apple through Telnet but "GET" is not a recognizable internal or external command is the error messge I get. Don't need to test my router anyway as it is fine. My friend is in another city so need to relay this info to him first.

There is no box to disable the remote management, you just uncheck "enable" on his router and it should be disabled. Maybe it's a bug in the firmware and it's not actually disabling it. We are talking about a 'Pine' router here which I've never seen any glowing reviews on.

Well, it is probably the router remote management interface. Can it be that you configured the router for remote management and opened that port?

You don't have to run telnet services. The command I wrote you before uses the telnet client to connect to port 8080. It allows you to directly communicate with the server that is running on port 8080. When you do

and then type in the connected telnet client

GET / HTTP/1.1 Host:

you should see the HTTP answer from apple.com. You can just tell me the IP of the router and I can try. As I wrote you, if there is a web server running, you can always use your browser and point it to http://a.b.c.d:8080/ with a.b.c.d being the IP addess of the router. I suspect its the remote administration interface. Just turn that off and it should close the port. I still cannot see that there is anything wrong with your router that you could not do wrong with any other router as well...

Gerald

Forget "stealth". Stealth is not possible and all what those routers do is drop the packets they receive instead of replying with a REJECT as they would do normally. Stealth is just a huge marketing fuzz that does not give you any benefits because a simple ping or connection attempt will tell you if there is a PC or not. If no PC is connected on an IP address you would get a "host unreachable". If you just don't answer it is a good indication that you are there. No reason, anyway not to start a port scan...

Gerald

Probably a typo somewhere. Anyway, you see that you get a response with some HTTP header lines and some HTML following. That's what a web server response looks like.

Just look into the headers of one of his recent e-mails. If he uses DSL the IP address should remain the same for a while...

Gerald