cancel
Showing results for 
Search instead for 
Did you mean: 

Firewall opens/closes connections (Port Forwarding: UDP)

FIXED
CaptainCorcoran
Hooked
Posts: 8
Thanks: 1
Registered: ‎20-04-2009

Firewall opens/closes connections (Port Forwarding: UDP)

I was looking at the event log for my Plusnet Hub One router (been having a few general connection/speed issues) and found a lot of messages like these when a second user is logged on to my PC... They all appear under the "Firewall" category...

21:58:01, 29 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.65]:33580 <-​-​> [146.90.157.42]:33580 -​ -​ -​ [71.239.74.88]:15977 ppp0 NAPT)
21:55:57, 29 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.65]:33580 <-​-​> [146.90.157.42]:33580 -​ -​ -​ [71.239.74.88]:49512 CLOSED/TIME_WAIT ppp0 NAPT)
21:55:42, 29 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.65]:33580 <-​-​> [146.90.157.42]:33580 -​ -​ -​ [71.239.74.88]:15977 ppp0 NAPT)
21:55:42, 29 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: TCP [192.168.1.65]:33580 <-​-​> [146.90.157.42]:33580 -​ -​ -​ [71.239.74.88]:49512 CLOSED/SYN_SENT ppp0 NAPT)
21:55:38, 29 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.65]:33580 <-​-​> [146.90.157.42]:33580 -​ -​ -​ [99.95.187.5]:50351 ESTABLISHED/ESTABLISHED ppp0 NAPT)
21:55:36, 29 Dec. (3104347.240000) Port forwarding rule added via UPnP/TR064. Protocol: TCP, external ports: any-​>33580, internal ports: 33580, internal client: 192.168.1.65
21:55:35, 29 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.65]:33580 <-​-​> [146.90.157.42]:33580 -​ -​ -​ [99.95.187.5]:27755 ppp0 NAPT)
21:55:30, 29 Dec. (3104341.150000) Port forwarding rule added via UPnP/TR064. Protocol: UDP, external ports: any-​>33580, internal ports: 33580, internal client: 192.168.1.65
21:55:25, 29 Dec. (3104336.340000) Port forwarding rule deleted via UPnP/TR064. Protocol: TCP, external ports: any-​>33580, internal ports: 33580, internal client: 192.168.1.65
21:55:21, 29 Dec. (3104332.010000) Port forwarding rule deleted via UPnP/TR064. Protocol: UDP, external ports: any-​>33580, internal ports: 33580, internal client: 192.168.1.65

It stops happening after the second user has logged off... Is this something I should be worried about ?

2 REPLIES 2
MrSilver
Pro
Posts: 550
Thanks: 82
Fixes: 9
Registered: ‎05-10-2016

Re: Firewall opens/closes connections (Port Forwarding: UDP)

Fix
So to confirm 1.65 is the ip of the pc?

The log shows that ip is asking the router to build a tunnel from external port 33580 to that pc. Upnp helps get round problems where people outside need to talk to a pc behind the firewall but the router doesn't know which one. Upnp allows a port to be picked and allocated to a pc. As the ports can be quite dynamic there isn't a good list of what port is what application.

Commonly found in games so you can do co-op play or host server. Also used by some voice apps. Does it appear soon as the user logs in?

If yes then look at the apps which are run at startup and if worried disable them and then turn them on a few at a time to narrow down what is causing it - see http://anewdomain.net/2015/07/26/how-to-disable-startup-programs-in-windows-10-and-speed-up-load-tim...

Most malware/viruses are more hidden than this, they don't need upnp as they make a connection through the firewall from the pc side.
CaptainCorcoran
Hooked
Posts: 8
Thanks: 1
Registered: ‎20-04-2009

Re: Firewall opens/closes connections (Port Forwarding: UDP)

Hi MrSilver Smiley

Thanks for replying

Since there's not much in the way of on-line gaming going on here, I had a look at voice apps as you suggested... I had a good look at the settings for Skype and that was where I found the frequently-offending port number and saw that it was started at login for the second pc user.

All my startup programs are now well & truly sorted out.

Many thanks for the advice and here's wishing you a very Happy New Year  Smiley Thumbs_Up