NMAP Scan - ProRemote?

Product Discussion Pepwave AP & Surf
1

I just ran the following nmap scan: nmap -v -A -p 1-65535 and found two open ports.

The first was the port I assigned for admin in lieu of 443. The second was “open port 8183/tcp”, which appears to have something to do with something called ProRemote. I have not enabled remote administration.

  1. Should either the admin port or 8183 be open?
  2. Should I close it/them?
  3. If so, how do I close it/them?

Thanks.

2

  1. What is your device model and firmware version ?

  2. How you do the scan ? via Internet or direct connect to device LAN/WAN interfaces ? In some cases if you scan via Internet, some of the ISP may have some proxy service for some ports, the Nmap scanning results may not accurate reporting the actual ports listening for the device. Can you please further confirm ?

1 Like
3

  1. Surf SOHO Mk3 running the firmware 1289 Build.

  2. I ran the nmap command from the MacOS Terminal from behind the router, inside the LAN.

However, please disregard for now. I cannot duplicate this result and will explore further resources.

4

I am able to duplicate this result…

When running Nmap portscan from LAN, targeting the Pepwave Surf soho mk3, using my private IP or public IP (from inside the network, LAN) the following ports are OPEN:
80/tcp http
443/tcp https
8183/tcp proremote

What is proremote service?

I will note that targeting the router from outside the network, using a VPN, all ports are closed. However I’m not very familiar with Nmap.

Maybe I’ll close the browser and try to scan it again…

5

TCP 8183 is used for Content Blocking. Please find the attached below.

Screenshot_1
Screenshot_11919×728 39.1 KB

6

Every router has an inside (LAN) and outside (WAN/Internet). Open ports on the WAN side are the far greater security issue. However, scannning the WAN side from the Internet is not optimal. Best to scan it internally, if possible. Connect WAN port of router to be scanned to LAN port of another router. Then scan from a computer on the LAN of the other router.

Ports 80 and 443 on the LAN side are for Local Admin of the router. You can disable port 80, probably a good idea. You can also change port 443 to something else, which would also make things a bit more secure. Pick a port over 9,000 and less than 65,000. And, if you use VLANs, you can limit all access to the router, regardless of port, to just one VLAN.