Port 64586

Just looking through some of my router logs and notice a lot of port forwarding to one of my machines on port 64586.

Now in my port forwarding settings there's nothing setup for that port or anything with that port range. So why is the router port forwarding to a specific machine on my network for this port?

Update
-----------
There seems to be around 3-4 requests a second all from different IP's, heres the log

11:30:48, 29 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.142:64586 <-&#8203;-&#8203;>MYEXTERNALIP:64586 [41.44.176.89:10337] ppp3 NAPT)
11:30:48, 29 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP 192.168.1.142:64586 <-&#8203;-&#8203;>MYEXTERNALIP:64586 [195.218.183.123:1756] ppp3 NAPT)
11:30:48, 29 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.142:64586 <-&#8203;-&#8203;>MYEXTERNALIP:64586 [75.94.164.194:63768] ppp3 NAPT)

Edited by AgentWalker (Mon 29-Dec-14 11:34:03)

Sounds like possibly uPNP. Some piece of software on that machine has opened a connection via uPNP and so it is being auto forwarded?

My guess would be that uPNP is enabled on your router and an application on the target machine is activating a port forward.
Is there a particular program/game running on the machine at the time?

You can try turning off uPNP on the router to see if it stops, or if an application on the machine has issues.

its looking that way, when I filter the logs its showing

11:33:42, 29 Dec. (848414.460000) Port forwarding rule added via UPnP/TR064. Protocol: UDP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142
11:33:38, 29 Dec. (848410.810000) Port forwarding rule deleted via UPnP/TR064. Protocol: UDP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142
11:33:35, 29 Dec. (848407.620000) Port forwarding rule added via UPnP/TR064. Protocol: TCP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142
11:33:31, 29 Dec. (848404.030000) Port forwarding rule deleted via UPnP/TR064. Protocol: TCP, external ports: any-&#8203;>64586, internal ports: 64586, internal client: 192.168.1.142

so it looks like UPnP is opening the ports.

Does that mean these requests are going out and not in? I thought UPnP was for something internal to dynamically open the ports it needs?

In reply to a post by panda:

My guess would be that uPNP is enabled on your router and an application on the target machine is activating a port forward.
Is there a particular program/game running on the machine at the time?

You can try turning off uPNP on the router to see if it stops, or if an application on the machine has issues.

the server there all going to is the media server running plex, sab, couch potato. but their ports are all setup manually.

might try closing them down one by one see what it is.

Edited by AgentWalker (Mon 29-Dec-14 11:43:28)

uPNP is (simplistically) an automated method of setting up the port forwards a particular application needs on demand, which can be a security issue if a rogue programme is able to open ports.

If you've set up the port forwards manually, you should be able to turn off uPNP.

If you're uncomfortable with uPNP you may be able to turn it off in the router; or disable it on your server.

Yeah thinking of doing that, I left it on for the PlayStation, tv etc to work without me setting the ports up.

tried setting the firewall on that machine so it blocks incoming and outgoing messages on that port and there still showing. Turning the machine off now to see if they show.


update
-------------
the machine is now off BUT there still showing in the log ummm

Edited by AgentWalker (Mon 29-Dec-14 11:59:48)

You may need to reboot the router to remove the port forward rules.
uPNP can be good at activating forwards, but not so good at removing them when no longer needed.

In reply to a post by panda:

You may need to reboot the router to remove the port forward rules.
uPNP can be good at activating forwards, but not so good at removing them when no longer needed.

the reboot seems to have got rid of them , thanks
will try the server again now

Update
------------------
Right, starting that server up seems to have started them calls again. Might just block them in that machines firewall as the HomeHub is pants and doesn't have an option to block things.

Edited by AgentWalker (Mon 29-Dec-14 12:22:32)