topic Re: Closed but open ports in Tech Help - Software/Hardware etc

Closed but open ports

Versailles — Mon, 23 Dec 2024 12:19:19 GMT

I had full fibre installed end of October 2024. Before upgrade, I could stream music from my Synology Nas to me Amazon Alexa via port 5001, using the AudioStation Skill. This skill needs a signed SSL certificate to operate, Synology offer certificates from "Lets Encrypt" and utillises port 443 for verification.
My router is Draytek 2860ac, and I have checked that ports 443 & 5001 are defined as open✅. But if I use an online open port checker they both are "CLOSED"
I think this "Closed" signal is stopping the SSL being verified, therefore stopping the Alexa Skill.
I think I'm right, as port 443 is an important port, if it's closed no Internet!
I have also had to set up Firewall tiles for my Andrews & Arnold VOIP service.
any thoughts anyone?

Re: Closed but open ports

MisterW — Mon, 23 Dec 2024 12:33:22 GMT

@Versailles what router did you use before the upgrade ? if it was the 2860 , I assume you were using the VDSL port which IIRC is WAN1. You are now connected to the ONT using the WAN port on the 2860 which is WAN2 ?

Do you need to modify the firewall rules to be active from WAN2 rather than WAN1 ?

Re: Closed but open ports

Versailles — Mon, 23 Dec 2024 13:05:02 GMT

@MisterW, Hi, yes ONT is connected to WAN2 port and NAT open port rules are for WAN2, moved from WAN1 when switched to fibre.
I know some of the porting works as I use port 444 for my remote access - Draytek SMARTVPN. Cheers Stu.

Re: Closed but open ports

MisterW — Mon, 23 Dec 2024 13:33:41 GMT

@Versailles AIUI the port will show as closed unless the NAS is actually running the Lets encrypt script. Only then will it (the NAS) be listening.

Although if this all worked previously on an FTTC(VDSL) connection and you've changed the NAT rules to WAN2 , the same rules should still work. Is there any useful info in the draytek log ?

TBH its a while since I've used a Draytek router. I used to have a 2830 but when I moved to FF it couldn't handle the throughput!

Re: Closed but open ports

Versailles — Mon, 23 Dec 2024 15:29:48 GMT

@MisterW, Yes, if it used to work it should now ✅

Not looked at the logs, as not sure what I'm looking for. From inside the NAS, I can obtain a SSL, but when I try to link it to Audiostation it fails to connect and if I try to link it on the amazon skills page, it says that it's not a valid SSL. confused or what!
could it be a conflict between an "Open Port rule" and my VOIP Firewall rules, but I thought ports 80 or 443 were always open, but according to online test their closed!

Re: Closed but open ports

MisterW — Mon, 23 Dec 2024 15:41:35 GMT

could it be a conflict between an "Open Port rule" and my VOIP Firewall rules

@Versailles i wouldn't have thought so, voip (SIP I assume?) would normally use port 5060 as the sip port and any rtp ports would be much higher.

Although I'm not quite sure why you would need rules for voip anyway. Normally its just a matter of ensuring the your voip equipment is configured for 'NAT keep alive' and then the router will keep the NAT pinhole open. I use voip myself and have not needed to add any firewall rules.

Re: Closed but open ports

mystreet1 — Mon, 23 Dec 2024 15:48:45 GMT

Looking at my router for my Synology NAS, I have ports 80,443,5001 and 5002 forwarding to the ip of my NAS
HTH

Re: Closed but open ports

Dan_the_Van — Mon, 23 Dec 2024 15:59:53 GMT

@Versailles

Do not confuse inbound and outbound ports.

For most routers used for domestic internet all outbound ports are open, you would have to open inbound ports as required using port forwarding rules.

Edit: there are some exceptions for some inbound ports but they are not used by all applications

Re: Closed but open ports

Versailles — Mon, 23 Dec 2024 17:49:45 GMT

@MisterW - I just followed the instructions & recommendations from my provider Andrews and Arnold, basically so only data/connections linked to their IP addresses would get through to my phone - it works so I don't really want to adjust too much on those settings

@mystreet1 - Cheers for the info.

@Dan_the_Van - Yes only trying to set inbound ports to get this Alexa Skill to work.

I think I'm going to have a deep dive into my VOIP firewall rules to see what being block and not. -If, no when I get it sorted I will add a final post just in case someone else has the same problem(s).

Re: Closed but open ports

MisterW — Mon, 23 Dec 2024 18:40:51 GMT

@Versailles yes I'm aware of the suggestion by A & A to restrict incoming connections to only their servers. In reality it's not needed unless you are running a PBX and using SRV records. If you are using normal VoIP equipment which registers a connection with A & A then any incoming connections will only come from the server you are registered to. So the normal NAT firewall will handle it and open a pinhole to just the a & a server thus blocking any unwanted connection. Just make sure you have keep-alive set to keep the pinhole open .

I use a & a at home with a gigaset n300 dect base , and know at least two other people who use it without needing any firewall rules.

Re: Closed but open ports

Versailles — Mon, 23 Dec 2024 21:20:26 GMT

@MisterW.
Thats very interesting, I have Groundstream 802 as VOIP to phone interface, Gigaset base station, so that sounds very similar to you. I will have to get in touch with A&A and ask why the need for a firewall! 🤔

Re: Closed but open ports

MisterW — Tue, 24 Dec 2024 07:39:08 GMT

@Versailles they no longer suggest a need for a Firewall if you are using NAT https://support.aa.net.uk/VoIP_Firewall

I have Groundstream 802 as VOIP to phone interface, Gigaset base station, so that sounds very similar to you

Not quite the same as mine, I just have a Gigaset N300 VOIP Dect unit and so don't need the Grandstream ATA. However I know others who are using the Grandstream ATA sucessfully with A & A. Just make sure that SIP keep alive is enabled.

Re: Closed but open ports

Dan_the_Van — Tue, 24 Dec 2024 07:59:10 GMT

@Versailles

I think it would be helpful if you described your home network, is everything connecting to the Draytek 2860ac or is there another device involved?

Having back to back routers causes double NAT and issue with port forward rules.

Re: Closed but open ports

Versailles — Tue, 24 Dec 2024 09:37:12 GMT

Uncomplicated set-up of:g
FTTP to Bt ONT,
ONT to Groundstrean 802 that connects to my Gigaset E45,
ONT to Draytek Vigor 2860ac,
from router to an 8 port switch,
Switch to Synology 218j NAS, 2 Desktops, printer and TV. Internally, 4 SSID's, Private, Guests, It's and o dedicated Alexa.
Going to leave this for a few days, apparently I have a list, and that doesn't include anything tech related 😢🙄.
Thanks so far, have a good one Stu.

Re: Closed but open ports

Versailles — Tue, 24 Dec 2024 09:41:23 GMT

@MisterW "they no longer suggest a need for a Firewall if you are using NAT https://support.aa.net.uk/VOIP Firewall" that was the information I followed, and understood was needed to be added to give a trouble free VOIP Service. 🤔

Re: Closed but open ports

mystreet1 — Tue, 24 Dec 2024 09:46:16 GMT

As @MisterW stated that you don't need to set up a firewall. First part of the page is

'If your phone on private IP addresses (eg 192.168.x.x, 10.x.x.x) then you won't need to set up the firewall as you're not using pubic IP addresses.'

Unless, you are using a public IP address

Re: Closed but open ports

MisterW — Tue, 24 Dec 2024 09:49:34 GMT

ONT to Groundstrean 802 that connects to my Gigaset E45,
ONT to Draytek Vigor 2860ac,

@Versailles que! That's not right, unless you've got a multi port ONT and multiple FTTP connections ?

Your 2860 should be connected to the ONT and make the PPPoE connection. The 802 should then connect to a LAN port on the 2860

Re: Closed but open ports

Versailles — Tue, 24 Dec 2024 10:09:15 GMT

@MisterW, oops sorry, my error, bit foggy this morning, yes the 802 does connect to a port on the switch.
@mystreet1, I thought, that as it was an external phone service, that was deemed as public not private.

Re: Closed but open ports

MisterW — Tue, 24 Dec 2024 10:24:02 GMT

I thought, that as it was an external phone service,

Nothing to do with the actual phone service, its the fact that the 802 is connected to the LAN and therefore has a private IP.

Its therefore behind the routers NAT firewall and the voip firewall rules arent needed

Re: Closed but open ports

Versailles — Tue, 24 Dec 2024 12:17:57 GMT

Hmm, well I think I/we may be getting somewhere, I will look at the A&A information again, turn the firewall off, and see what happens, hopefully this afternoon. 🤞