Technical Discussion
  >> Home Networking, Internet Connection Sharing, etc.


Register (or login) on our website and you will not see this ad.


Pages in this thread: 1 | 2 | (show all)   Print Thread
Standard User AgentWalker
(experienced) Mon 29-Dec-14 11:29:47
Print Post

Port 64586


[link to this post]
 
Just looking through some of my router logs and notice a lot of port forwarding to one of my machines on port 64586.

Now in my port forwarding settings there's nothing setup for that port or anything with that port range. So why is the router port forwarding to a specific machine on my network for this port?

Update
-----------
There seems to be around 3-4 requests a second all from different IP's, heres the log

11:30:48, 29 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.142:64586 <-&#8203;-&#8203;>MYEXTERNALIP:64586 [41.44.176.89:10337] ppp3 NAPT)
11:30:48, 29 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP 192.168.1.142:64586 <-&#8203;-&#8203;>MYEXTERNALIP:64586 [195.218.183.123:1756] ppp3 NAPT)
11:30:48, 29 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.142:64586 <-&#8203;-&#8203;>MYEXTERNALIP:64586 [75.94.164.194:63768] ppp3 NAPT)

Edited by AgentWalker (Mon 29-Dec-14 11:34:03)

Standard User ian72
(eat-sleep-adslguide) Mon 29-Dec-14 11:34:32
Print Post

Re: Port 64586


[re: AgentWalker] [link to this post]
 
Sounds like possibly uPNP. Some piece of software on that machine has opened a connection via uPNP and so it is being auto forwarded?
Standard User panda
(committed) Mon 29-Dec-14 11:39:53
Print Post

Re: Port 64586


[re: AgentWalker] [link to this post]
 
My guess would be that uPNP is enabled on your router and an application on the target machine is activating a port forward.
Is there a particular program/game running on the machine at the time?

You can try turning off uPNP on the router to see if it stops, or if an application on the machine has issues.

Eats shoots and leaves.


Register (or login) on our website and you will not see this ad.

Standard User AgentWalker
(experienced) Mon 29-Dec-14 11:40:53
Print Post

Re: Port 64586


[re: ian72] [link to this post]
 
its looking that way, when I filter the logs its showing

11:33:42, 29 Dec. (848414.460000) Port forwarding rule added via UPnP/TR064. Protocol: UDP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142
11:33:38, 29 Dec. (848410.810000) Port forwarding rule deleted via UPnP/TR064. Protocol: UDP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142
11:33:35, 29 Dec. (848407.620000) Port forwarding rule added via UPnP/TR064. Protocol: TCP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142
11:33:31, 29 Dec. (848404.030000) Port forwarding rule deleted via UPnP/TR064. Protocol: TCP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142

so it looks like UPnP is opening the ports.

Does that mean these requests are going out and not in? I thought UPnP was for something internal to dynamically open the ports it needs?
Standard User AgentWalker
(experienced) Mon 29-Dec-14 11:42:53
Print Post

Re: Port 64586


[re: panda] [link to this post]
 
In reply to a post by panda:
My guess would be that uPNP is enabled on your router and an application on the target machine is activating a port forward.
Is there a particular program/game running on the machine at the time?

You can try turning off uPNP on the router to see if it stops, or if an application on the machine has issues.


the server there all going to is the media server running plex, sab, couch potato. but their ports are all setup manually.

might try closing them down one by one see what it is.

Edited by AgentWalker (Mon 29-Dec-14 11:43:28)

Standard User panda
(committed) Mon 29-Dec-14 11:49:51
Print Post

Re: Port 64586


[re: AgentWalker] [link to this post]
 
uPNP is (simplistically) an automated method of setting up the port forwards a particular application needs on demand, which can be a security issue if a rogue programme is able to open ports.

If you've set up the port forwards manually, you should be able to turn off uPNP.

Eats shoots and leaves.
Standard User AlanAtHome
(learned) Mon 29-Dec-14 11:51:13
Print Post

Re: Port 64586


[re: AgentWalker] [link to this post]
 
If you're uncomfortable with uPNP you may be able to turn it off in the router; or disable it on your server.
Standard User AgentWalker
(experienced) Mon 29-Dec-14 11:58:14
Print Post

Re: Port 64586


[re: AlanAtHome] [link to this post]
 
Yeah thinking of doing that, I left it on for the PlayStation, tv etc to work without me setting the ports up.

tried setting the firewall on that machine so it blocks incoming and outgoing messages on that port and there still showing. Turning the machine off now to see if they show.


update
-------------
the machine is now off BUT there still showing in the log ummm

Edited by AgentWalker (Mon 29-Dec-14 11:59:48)

Standard User panda
(committed) Mon 29-Dec-14 12:09:31
Print Post

Re: Port 64586


[re: AgentWalker] [link to this post]
 
You may need to reboot the router to remove the port forward rules.
uPNP can be good at activating forwards, but not so good at removing them when no longer needed.

Eats shoots and leaves.
Standard User AgentWalker
(experienced) Mon 29-Dec-14 12:18:31
Print Post

Re: Port 64586


[re: panda] [link to this post]
 
In reply to a post by panda:
You may need to reboot the router to remove the port forward rules.
uPNP can be good at activating forwards, but not so good at removing them when no longer needed.


the reboot seems to have got rid of them , thanks
will try the server again now smile

Update
------------------
Right, starting that server up seems to have started them calls again. Might just block them in that machines firewall as the HomeHub is pants and doesn't have an option to block things.

Edited by AgentWalker (Mon 29-Dec-14 12:22:32)

Pages in this thread: 1 | 2 | (show all)   Print Thread

Jump to