Hi  @Clive_A 

> telnet ip port and can you use these ports?

telnet shows connected on port 1723

> Can you make sure it is not a false alarm?

Running the nmap on public IP from the local network, port 1723 was still shown as open. Only port 8080 is closed now. All other ports remain open.

➜  ~ nmap -v -Pn 122.**.**.21    
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94 ( https://nmap. org ) at 2023-12-21 09:36 IST
Initiating Parallel DNS resolution of 1 host. at 09:36
Completed Parallel DNS resolution of 1 host. at 09:36, 0.02s elapsed
Initiating Connect Scan at 09:36
Scanning 122.**.**.21 [1000 ports]
Discovered open port 53/tcp on 122.**.**.21
Discovered open port 443/tcp on 122.**.**.21
Discovered open port 80/tcp on 122.**.**.21
Discovered open port 1723/tcp on 122.**.**.21
Completed Connect Scan at 09:36, 0.12s elapsed (1000 total ports)
Nmap scan report for 122.**.**.21
Host is up (0.00044s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
443/tcp  open  https
1723/tcp open  pptp
 

Read data files from: /usr/local/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds

Also, I have added a Gateway ACL to block all open ports, but it's not working as expected. The Gateway ACL looks like this: 

DIRECTION - WAN IN  
POLICY - DENY  
PROTOCOLS - ALL  
SOURCE - IP Group:IPGroup\_Any  
DESTINATION - IP-Port Group:Gateway Open Port  

In the destination IP-Port Group (Gateway Open Port), I included the router local IP and all open ports, but the block is not being applied.

I also tried Gateway ACL with only open ports (without router local IP) still scan results are the same.

However, a similar Switch ACL blocks these open ports on the local network. The Switch ACL looks like this:

POLICY - DENY  
PROTOCOLS - ALL  
SOURCE - IP Group:IPGroup\_Any  
DESTINATION - IP-Port Group:Gateway Open Port  

here is the scan result when the above Switch ACL is enabled

➜  ~ nmap -v -Pn 172.16.10.1   
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94 ( https://nmap. org ) at 2023-12-21 10:03 IST
Initiating Parallel DNS resolution of 1 host. at 10:03
Completed Parallel DNS resolution of 1 host. at 10:03, 4.02s elapsed
Initiating Connect Scan at 10:03
Scanning _gateway (172.16.10.1) [1000 ports]
Completed Connect Scan at 10:03, 1.32s elapsed (1000 total ports)
Nmap scan report for _gateway (172.16.10.1)
Host is up (0.00045s latency).
Not shown: 995 closed tcp ports (conn-refused)
PORT     STATE    SERVICE
53/tcp   filtered domain
80/tcp   filtered http
443/tcp  filtered https
1723/tcp filtered pptp
8080/tcp filtered http-proxy

Read data files from: /usr/local/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 5.38 seconds

Hi  @Clive_A ,

I want to clarify that I am not using any NAT device in my network. Also, I am using the router in controller mode, not in standalone mode. In my understanding, resetting the router would not make any sense as it will be adopted by the same controller and the same configuration will be applied again after resetting. Can you please confirm if my understanding is correct or not?

​Also, my ISP is blocking all well-known ports, the PPTP port is blocked by my ISP. I can also confirm this because today I ran the same scan on my public IP from a remote network. So, for now, I can live in peace. However, I'll check it again once v1.1.1 is publicly available.

  @di-vin 

You have somthing here, I do a scan from LAN and WAN and the result is the same on pptp port.
ER8411 have pptp port closed but not ER707-M2 and ER706W

I have a newer firmware on my ER8411, have you tried this one?  https://community.tp-link.com/en/business/forum/topic/636166

ER8411 1.1.1 Build 20231120 Rel.51697
PORT    STATE SERVICE
22/tcp  open  ssh
53/tcp  open  domain
80/tcp  open  http
443/tcp open  https

ER707-M2 1.1.1 Build 20230927 Rel.35167
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
80/tcp   open  http
443/tcp  open  https
1723/tcp open  pptp
2601/tcp open  zebra

ER706W 1.0.2 Build 20231020 Rel.57490(4555)
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
443/tcp  open  https
1723/tcp open  pptp
2601/tcp open  zebra
 

Hi  @MR.S @Clive_A 

The only difference is, that my ER8411 running firmware version 1.1.0. As I mentioned earlier I can not install beta firmware. I'll wait till public release. BTW, @Clive_A do you guys have any ETA on the v1.1.1 public release?

@MR.S why is it showing the PPTP port open on ER707-M2 and ER706W? Are you using this service or it is open by default?

  @di-vin 

PPTP is old and outdated and insecure so I don't use it so this is not something I have opened.

but since it is clearly fixed on the ER8411, I hope it will also be fixed on the other router models with next update..

  @di-vin

  @Clive_A 

I have to add :