Network Setup - What port to use for the Router? Maybe port 8080?

[doliveira 0]

Hi,

 

I’m setting up my small office network and on my server I will use the “Windows Server 2012 R2 Essentials” and I will want to enable and use the “Anywhere Access” and “VPN” build in features to have remote access to my server from outside.

 

Regarding this, my router uses as factory default the port 80 to access the admin interface. 

 

But I think I should change this in order for my router not to be visible from outside world, and also not to conflict with any of the Windows Server services, correct? It’s a best practice to do this correct?

 

If yes, I really don’t know which port I should use. I’m think on using port 8080 so the router access from inside my network will become: http://192.168.0.1:8080.

 

So can anyone please share your advice on which port I should use for my router admin interface access?

 

It must be a port that can only have access from my internal network and it must be a port not used by common services in order not to create conflicts. 

 

Thanks

 

[Andne 13]

The router can still be accessed from port 80, as long as it's only providing that access on the LAN interface.  Some routers do like to provide access to their admin interface through the WAN interface which is probably not what you want.  Ports don't distinguish between internal and external access, the interface the port is available on does, but every interface can support all port numbers.  So, ideally your configuration should probably look something like this.  How exactly to create this configuration depends on the hardware/software you're using.

 

Router WAN interface:

port 80 -> forward to WS2012R2E server IP address

port 443 -> forward to WS2012R2E server IP address

All other ports blocked (should be default behavior without a forwarding rule)

 

Router LAN interface:

port 80 -> used for admin web interface

 

Other notes/suggestions:

Set the WS2012R2E server to either a static IP address outside the DHCP range or have the router statically allocate an IP address to it's MAC address.  I prefer the first one.

Don't rely on WS2012R2E autoconfiguring the router (uses uPnP), manually forward ports 80 and 443 in the router web interface.

Internal access to the WS2012R2E web site can be a bit tricky, it's easiest if the router supports redirecting internal traffic to the WAN interface back to the LAN (sometimes it's an option somewhere).

[doliveira 0]

Hi @Andne,

 

Thanks for all your advices. I have all setup as you said. But if i leave my router on port 80 i will have access to it from outside my internal LAN. So outside my office the router aadmin page will be available.

 

So i really need to change my router port to an unused port so i can access to it only from my internal LAN. 

 

Any advices on recommended ports?

 

Thanks

[jmwills 284]

The Admin page will not be available from the outside unless you make it available. There is usually an option to enable or disable this function.

[doliveira 0]

The Admin page will not be available from the outside unless you make it available. There is usually an option to enable or disable this function.

 

Ok,... but let not discuss anymore that. In my case i want to change the default router admin port. 

 

So can anyone advise me on a unused port that i can use without problems?

 

Thanks

[Andne 13]

Just changing the port number will not block outside access to your router.  There should be another option somewhere to enable/disable external/remote access to the router admin interface (the exact naming varies by router).  I did a little digging, looks like it's located in Maintanance->Setup->Remote Management on your router.  As long as the 'List of Subnet' is either empty or only contains the internal network IP addresses (not sure which is correct, empty may block all access), the router will not be accessible externally.

 

As far as using a different port goes, most ports will work, only a few of them have specific functions and most of those are below 1024.  8080 and 8088 are probably the two most commonly used alternate ports for web sites.  Picking an appropriate port does require some knowledge of everything else that is in use on the router, but it's very unlikely anything else would be on either one of those ports.  Generally, ports below 1024 have standard assignments for their function (80 is HTTP, 443 is HTTPS, 22 is SSH, etc...) and ports above 1024 are application specific.  The highest port number is 65535 (max 2-byte value).

 

Here's the manual I got the Remote Management information from:

http://www.tp-link.com/resources/document/TL-ER5120_V2_User_Guide_1910010931.pdf

[doliveira 0]

Just changing the port number will not block outside access to your router.  There should be another option somewhere to enable/disable external/remote access to the router admin interface (the exact naming varies by router).  I did a little digging, looks like it's located in Maintanance->Setup->Remote Management on your router.  As long as the 'List of Subnet' is either empty or only contains the internal network IP addresses (not sure which is correct, empty may block all access), the router will not be accessible externally.

 

As far as using a different port goes, most ports will work, only a few of them have specific functions and most of those are below 1024.  8080 and 8088 are probably the two most commonly used alternate ports for web sites.  Picking an appropriate port does require some knowledge of everything else that is in use on the router, but it's very unlikely anything else would be on either one of those ports.  Generally, ports below 1024 have standard assignments for their function (80 is HTTP, 443 is HTTPS, 22 is SSH, etc...) and ports above 1024 are application specific.  The highest port number is 65535 (max 2-byte value).

 

Here's the manual I got the Remote Management information from:

http://www.tp-link.com/resources/document/TL-ER5120_V2_User_Guide_1910010931.pdf

 

Thanks for all your advices!