Plusnet Firewall issue

[#1]

other ports such as 50000 would be blocked too

The short answer is no they wouldn't

When a application establishes a remote connection it uses an random port between 49152 to 65535 to contact the port the application is listening to, for a web browser http is 80 and https is 443, example of my pc with https connection

TCP 192.168.1.106:58908        34.120.67.236:443      ESTABLISHED
So the link established between the two hosts is port 58908 on my LAN connection to port 443 at the remote end, this connection is maintained until the application closes it. So in the above example the INBOUND connection to my network is on port 58908. This is how TCP/IP works.

Where all this can go wrong is when Modem/Router like a Hub One is connected to a second router and double NAT comes to play, not the end of the world but adds a level of confusion. Second Router could have be added to improve wifi coverage, for this the second router should be setup as a Wireless Access Point.

TCP/IP is a multi layered subject.

Dan

[#2]

But surely it would be the vpn client trying to connect to 50000 which would be blocked by PN? No outbound connection from my router to the client has been established at this stage.

[#3]

GRC Port Authority Report created on UTC: 2021-11-24 at 11:37:48

Results from scan of ports: 0, 21-23, 25, 79, 80, 110, 113, 
                            119, 135, 139, 143, 389, 443, 445, 
                            1002, 1024-1030, 1720, 5000

    0 Ports Open
    0 Ports Closed
   26 Ports Stealth
---------------------
   26 Ports Tested

ALL PORTS tested were found to be: STEALTH.

TruStealth: PASSED - ALL tested ports were STEALTH,
                   - NO unsolicited packets were received,
                   - NO Ping reply (ICMP Echo) was received.

This is my current shieldsup results.  The current setting on plusnet account broadband firewall is "DISABLED".  Cannot change settings to any high low etc because of error message when trying to save settings.

If I initiate a new outgoing connection to BBC.  I am able to get BBC iPlayer without any problems because current setting allow ESTABLISHED and RELATED connections.

But NEW in coming connections are drop.

Previously when plusnet broadband firewall was working. Shieldsup would show https and http as open.

[#4]

Would be grateful if you could test changing and saving your plusnet firewall settings. Mine just comes up with error message.

[#5]

Wouldn't they only show as open if there was something listening on those ports?  Do you have anything?  I don't know what router you are using (sorry if you've stated it higher up), but if it's the Hub One then I'm pretty sure it doesn't allow remote management so doesn't listen on those ports itself.  The only way they would be open with it is if you port forwarded them to something that was listening.

[#6]

On my plusnet hub one router port 80 is forwarded to ip address port 1953. Shieldsup still show port 80 as Stealth

[#7]

@james33 

If the Plus Net firewall is off then it can only be your modem/router firewall blocking the traffic unless it (Plus Net firewall) is not working as intended. My understanding is the Plus Net firewall does not negate the Modem/Router firewall settings.

As @pjmarsh said unless something is listening to the required port it will not show the port is open, as I previously stated. I don't think shields up tests UDP connections.

I would avoid using common ports for any connection unless absolutely necessary, like a web server.

@kissinuk 

Perhaps setting to HIGH does stop an inbound VPN connection on all port,  I can't say I've never tried it. What ever you may need to setup a port forward rule for any inbound connection to a VPN Server.

Not sure I can add anymore.

Dan.

[#8]

Here is my plusnet hub one screenshot.

[#9]

For clarity

Plus Net Firewall = Broadband Firewall accessed via the members centre.

Modem/Router = Hub One or 3rd Party device.

@james33 

My Hub One firewall setting matches yours.

If I understand correctly

Broadband Firewall setting is OFF then it will be the Hub One firewall only blocking traffic.

LOW the Hub One Firewall still blocks traffic, but no longer needs to  block 53, 111, 135, 137, 138, 139, 445, 515, 1080, 1433, 3128, 3306, 6000 as these never reach your Hub One as they are already blocked by the Broadband Firewall.

HIGH not recommended setting for VPN services.  

Stepping back, are you trying to connect to a VPN Server using a VPN Client or connecting to a local VPN Server hosted on your home network from somewhere outside?

[#10]

The problem is the PN firewall is broken - what it displays is not necessarily what is happening. Mine displays 'off' but it is actually set to 'high' .

[#11]

I am trying to connect to a local VPN Server hosted on my home network from somewhere outside.  I had this setup for 3-4 years worked without any problems until I am unable to switch plusnet broadband firewall to block common ports except http and https.

[#12]

Thanks. Perhaps we should ask Plusnet to solve this problem asap. I suppose we just have to wait.  They took one whole week to fix the webmail problem recently.

[#13]

It's now 3 weeks since I first raised this with PN, still no updates and no working firewall. Not even a mention on the service status.

*Please* can you give as an idea of when this might be fixed.

[#14]

Please accept our apologies for the inconvenience this has caused thus far. Our team are working on a fix but we did don't have any timescales for now.

[#15]

Thanks for reminding plusnet to sort the firewall issue.  I am still waiting to use my home vpn.  I noted past issues with plusnet firewall in 2018 highlighted on the forum.  Plusnet please get cracking!