[SOLVED] Port-forwarded followed by malicious access attemps

[Jcharby]

Hi all,

I recently figured out how to activate a port-forward on my network to use for a Minecraft server with friends. After creating the port-forward on the Minecraft TCP/UPD port 25565, I noticed multiple malicious access attempts originating from locations such as within the US, China, and South Korea trying to access the port 27032. It appears that luckily no access has been granted as all attempts have been blocked by my internet security.

Can anyone provide insight on why access would be attempted on that port even though I only have the single port forward on 25565 active on my router?
How much of a concern are these access attempts and is there a way to "close" that port to access attempts even though I never opened it with a port-forward in the first place?

I am in the process of contacting my service provider for insight as well, but wanted to reach out here for information as I tend to get a lot of valuable input here.

Thank you,
Jack

 

[bill001g]

If you are seeing these in some router log then the router is doing its job. In many ways it would be better if the router did not produce any messages. Because there is not port forwarding rules the traffic will always be dropped because the router does not know which internal machine to send it to. So nothing gets to your internal machines. You can do nothing to prevent the traffic getting to your router. The router does not even know about the traffic until it receives it and by then it is to late to prevent it from being sent.

So pretty much the message is warning about something you can do nothing about and it causes no issues.

 

[SamirD]

Yep, bill001g is on point.

But on a related note, I have no idea why isps even allow international traffic on all IPs. There are only a fraction of people that need international access to china or other threat actors, and imo by default the traffic from these and other hostiles simply needs to be blocked from even traversing the isp in the first place. All these attacks waste bandwidth and cause issues for the isp, the users, and ultimately--the whole country, no matter what country it is.