Open router and VPN ports: how to check after the Ivanti hacks
How to check whether your network is exposed: external IP, port scans, Shodan, UPnP and IPv6, explained after the Ivanti VPN gateway breaches.
Checking whether a home or office network is visible from the internet takes about an hour. Find the external IP address, scan it from outside, look at what device search engines Shodan and Censys already know about it, and go through four router settings: remote management, UPnP, port forwarding and IPv6. The Ivanti breach waves show why this matters. Attackers stopped going through employee laptops long ago. They go through the box at the edge of the network, the one that answers internet requests around the clock.
What happened with Ivanti, and why it is still news after three years
Ivanti Connect Secure, formerly Pulse Secure, is a VPN gateway for remote access. Companies and government agencies use it so staff working from home can reach the internal network. By design the gateway faces the internet, and that is the whole problem.
In January 2024 Volexity disclosed two zero-day vulnerabilities: CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection). Chained together, they gave full control of the gateway without a password. Volexity linked the attacks to a China-based group and within days counted more than 1,700 compromised devices.
The timeline that followed:
| Date | Event |
|---|---|
| January 2024 | CISA issues Emergency Directive 24-01 for US federal agencies |
| February 1, 2024 | CISA orders agencies to disconnect Ivanti gateways by February 2 |
| February 29, 2024 | CISA and partners warn that Ivanti’s own integrity checker misses compromises |
| March 2024 | CISA admits two of its own systems were breached through Ivanti |
| April 2024 | MITRE reports a breach of its NERVE research network through the same Ivanti flaws |
| January 2025 | CVE-2025-0282, CVSS 9.0, exploited since mid-December 2024 according to Mandiant |
| April 2025 | CVE-2025-22457, CVSS 9.0, Mandiant attributes attacks to China-nexus group UNC5221 |
The integrity checker detail matters more than the rest. Administrators ran the official tool, saw a clean result and moved on. According to CISA, attackers could keep root access even after a factory reset. The takeaway is blunt: once an edge device is compromised, a report generated by that same device proves very little.
The scale is real too. In spring 2025 the Shadowserver Foundation counted about 5,000 unpatched Ivanti Connect Secure gateways reachable from the internet. That is one vendor and one product.
Why a home router is part of the same story
Ivanti sits in corporations. An ordinary household has a cheap router. The gap is smaller than it looks. Both are edge devices with a web interface, proprietary firmware and rare updates. Neither runs antivirus, and almost nobody reads their logs.
Recent examples:
- In November 2016 a Mirai variant used port 7547 (the TR-069 remote management protocol) to knock about 900,000 Deutsche Telekom customer routers offline.
- In January 2024 the FBI dismantled the KV botnet, which the Chinese group Volt Typhoon used to hide its traffic. Its backbone was hundreds of old Cisco and Netgear routers that had reached end of life.
- In September 2024 the FBI described the Raptor Train botnet run by Flax Typhoon: more than 260,000 devices, mostly home routers, cameras and network storage boxes.
A home router is rarely the target in itself. It is a relay. Through someone’s residential IP, an attack looks like traffic from a regular person in the US, Europe or Russia rather than a request from a data center. Owners often find out last, when their IP lands on blocklists and websites start throwing captchas.
Do you have a public IP address
The first question is whether internet traffic reaches the router at all. Many providers, mobile carriers especially, put customers behind CGNAT, where hundreds of subscribers share one external IP. In that case the router cannot be reached over IPv4 from outside, and half the problems disappear.
The check is simple. Look at the WAN address in the router’s web interface and compare it with what an external service reports:
curl -4 ifconfig.me
curl -6 ifconfig.meIf the addresses match, the IP is public and the router is directly reachable. If the router shows an address from 100.64.0.0/10, 10.x.x.x or 192.168.x.x while the external service shows something else, the network sits behind the provider’s NAT. The second command reveals whether IPv6 is present. If it is, see the IPv6 section below.
How to scan your router’s open ports from outside
Scanning from inside the home network is pointless. The router answers on its internal interface and shows ports that are closed from outside. A vantage point outside the network is needed: a VPS at $3-5 a month (estimate) or a laptop tethered to a phone on mobile data.
The standard tool is nmap. Scan only your own address. Scanning other people’s networks is illegal in many countries and breaks almost every hosting provider’s terms.
# all TCP ports, show only open ones
sudo nmap -Pn -sS -p- --open 203.0.113.10
# top 50 UDP ports
sudo nmap -Pn -sU --top-ports 50 203.0.113.10Replace 203.0.113.10 with your external IP. A full TCP scan takes 5 to 20 minutes, UDP is slower. The -Pn flag is there because many routers ignore ping, and without it nmap assumes the host is down.
A good result: no open ports, or only the ones opened deliberately. A bad one: the router web interface on 80, 443 or 8080, Telnet on 23, anything on 7547.
UDP has a quirk. WireGuard does not respond to packets without a valid key, so nmap reports its port as “open|filtered”, meaning “can’t tell”. That is how the protocol is designed, not a scanner bug.
How to see your network the way Shodan and Censys see it
Shodan and Censys scan the entire IPv4 internet nonstop and record what answers at every address. Attackers start there. After an Ivanti vulnerability goes public, a list of vulnerable gateways takes one query and a minute.
Shodan offers a free lookup that needs no account:
curl https://internetdb.shodan.io/203.0.113.10The JSON response lists open ports, detected software, known CVEs and tags such as “vpn” or “iot”. An empty response means Shodan found nothing at that address. For details there is the page shodan.io/host/your-IP and a command-line client:
pip install shodan
shodan init YOUR_API_KEY
shodan host 203.0.113.10Censys works similarly at search.censys.io. Data in both databases can be a week old. A port closed today may still appear in Shodan for a while. The reverse is also true: a fresh port forward will not show up immediately.
Which open ports are dangerous
| Port | What it is | Risk |
|---|---|---|
| 23/TCP | Telnet | Critical: plaintext passwords, a botnet favorite |
| 7547/TCP | TR-069, ISP management | High: history of mass compromises |
| 80, 443, 8080/TCP | Router web interface | High: password guessing and firmware bugs |
| 8291/TCP | MikroTik Winbox | High: a recurring target in MikroTik attacks |
| 1900/UDP | UPnP SSDP | Medium: abused for DDoS amplification |
| 3389/TCP | Windows RDP | High: the main ransomware entry point |
| 445/TCP | SMB | Critical: the WannaCry route in 2017 |
| 5900/TCP | VNC | High: often has no password at all |
| 22/TCP | SSH | Depends: tolerable with keys, not with passwords |
| 500, 4500/UDP | IPsec | Fine for VPN with current firmware |
| 1194/UDP | OpenVPN | Fine if the server is up to date |
| 51820/UDP | WireGuard | Low: silent without a key |
The logic is simple. A service that answers anyone and shows a login page is a target. A service that stays silent for strangers is nearly invisible.
What to check in the router settings
Remote management
The menu item is usually called Remote Management, Remote Access or WAN Access. Many models ship with it off, but ISP technicians sometimes switch it on during installation for their own convenience. If it is on, the router’s web interface is open to the whole world.
UPnP
UPnP lets software inside the network open router ports by itself. Handy for game consoles and torrents. Less handy when an infected camera does the same. Current rules are visible from any computer on the network:
sudo apt install miniupnpc
upnpc -lThe output lists forwards that devices created on their own. Unknown entries with ports such as 3389 or 23 mean some device decided to become reachable from outside without the owner knowing.
Port forwarding and DMZ
Manual forwarding rules live for years. The video recorder installed in 2019 is long gone, but the port pointing to its old address is still open. DMZ mode is a separate case: it sends every incoming connection to a single device.
WPS and TR-069
WPS simplifies Wi-Fi setup with a PIN that can be brute-forced in a few hours. TR-069 lets the ISP manage the router remotely. On a rented router it usually cannot be disabled, but it helps to know it exists.
Firmware and end of life
The KV botnet was built from routers that no longer received updates. The model and the date of the latest firmware are easy to find on the vendor’s site. If the last update came out 3-4 years ago, the device is effectively frozen with every known hole intact.
How to check your own VPN server or VPS
People running their own VPN server face a different picture. What matters is both what listens on a port and what the firewall lets through. To see every listening service:
sudo ss -tulpnLines with 0.0.0.0 or [::] listen on all interfaces, which means they may be reachable from the internet. 127.0.0.1 means local access only. Then the firewall:
sudo ufw status verbose
# or, without ufw
sudo nft list rulesetA common story: a VPN admin panel, a database or a Docker container listens on all interfaces when it should be internal only. Docker also publishes ports straight through iptables and bypasses ufw rules. That is why the final answer still comes from an external nmap scan.
The protocol difference is visible here. Corporate SSL VPNs such as Ivanti, Fortinet or Cisco expose a full web server with a login page: a large attack surface. WireGuard exposes one UDP port and stays silent without a key. That does not make it invulnerable, but it explains why the mass breach waves of recent years hit SSL VPNs specifically.
Why IPv6 breaks the whole picture
Many people believe NAT protects home devices because only the router is visible from outside. With IPv4 that is roughly true. With IPv6 every device on the network gets its own global address, and NAT plays no part.
Protection then depends entirely on the router’s IPv6 firewall. Most modern models block inbound connections by default, but not all, and it is easy to switch off in settings. Shodan scans IPv6 far less effectively than IPv4 because the address space is too large to sweep. That is not protection, it is a lottery.
To check, find the IPv6 address of a specific device, such as a NAS or a camera, and scan it from an outside server that also has IPv6:
sudo nmap -6 -Pn --top-ports 1000 2001:db8::1234If the device’s ports show up as open, the router’s IPv6 firewall is letting them through.
How to tell if the router is already compromised
The Ivanti experience says self-diagnosis on a compromised device is unreliable. Still, home routers leave typical traces:
- DNS servers in the WAN or DHCP settings have changed;
- forwarding or UPnP rules appeared that nobody created;
- a new administrator account shows up in the user list;
- outbound traffic climbs at night while everyone is asleep;
- the external IP is on blocklists and websites started showing captchas.
An IP can be checked against blocklists on services such as AbuseIPDB or Spamhaus. No single sign proves a breach, but two or three together are a serious signal. In the Ivanti case CISA told agencies to assume compromise rather than trust the vendor tool’s report.
How long the check takes
| Step | Time (estimate) | What you need |
|---|---|---|
| Compare external IP with WAN | 2 minutes | Browser |
| Shodan InternetDB lookup | 1 minute | Browser or curl |
| Walk through router settings | 10-15 minutes | Admin password |
| List UPnP forwards | 5 minutes | Computer on the network |
| External nmap scan | 15-30 minutes | VPS or mobile data |
| IPv6 check | 10 minutes | Server with IPv6 |
The total is 45 minutes to an hour and a half the first time. Repeat checks go faster because it is clear what to look for.
The catch: scanners don’t see everything
An external scan shows which doors are open right now. It does not show outbound connections. An infected device can dial out to an attacker’s server and hold a tunnel open while every inbound port stays closed. Many modern botnets and remote access tools work exactly like that.
The second blind spot is cloud management. Routers with a vendor mobile app keep a permanent connection to the vendor’s cloud. If the cloud or the owner’s account is compromised, open ports are not needed at all.
The third is ISP equipment. A rented router has a TR-069 channel, and its security depends on the provider, not the subscriber.
In the end, the Ivanti story is not about one brand. Fortinet, Cisco, Citrix, Palo Alto and SonicWall have all been through similar waves. Any box that answers internet requests ends up in someone’s database sooner or later. The difference between an owner who knows what is exposed and one who doesn’t usually becomes clear on the day the next vulnerability is published.