Recently I upgraded my home router into this one. It is a cheap one, but it has features I needed: IPv6 support and Gigabit Ethernet.
So I decided to give IPv6 a try. I configured a Hurricane Electric tunnel, so every PC on my home LAN got a public IPv6 address. I configured IPv4 firewall and NAT quite easily through web interface, but the router has very simple IPv6 firewall - it blocks anything incoming. So I disabled it and configred Windows Firewall on each individual PC.
Recently I tried to check the security of my network, so I did a Nmap scan of each host. Everything was OK until I got this output for my router:
Not shown: 992 closed ports
PORT STATE SERVICE
23/tcp open telnet
53/tcp open domain
6666/tcp filtered irc
6667/tcp filtered irc
6668/tcp filtered irc
6669/tcp filtered irc
7000/tcp filtered afs3-fileserver
9999/tcp filtered abyss
Nmap done: 1 IP address (1 host up) scanned in 16.55 seconds
And this was the public address (Client IPv6 Endpoint). Scanning the IP from routed prefix gave same results. telnet
gives me a login prompt which accepts my router username and password (its weird that web interface doesn't listen on IPv6 address). The router also does a DNS Proxy for my network, thats why port 53 is open.
How big of a security problem this can be? Is there anything I can do?
Update: I have contacted the consumer support and they told that they condiser to implement IPv6 firewall in next firmware version. It is going to have configurable rules.
I can disable DNS proxy service and set DNS servers on individual PCs. If I ignore the open telnet
port, will I be safe enough?
Update 2 Actually disabling the service didn't work as expected: it just stopped giving the routers IP as a DNS server through DHCP, so I configured the router to give my ISP DNS servers. It is still listening on the public IPv6 address. However, I managed to disable telnet entirely on both IPv4 LAN and IPv6 address.