hi kids, this is your dad, huahuanjayy wkwkwk, Nuenomaru the handsome is back in action.
Okay, this time your dad is going to write a tutorial Router Exposure Audit and Basic Hardening.
1. Introduction: When Your Router Appears on Shodan
- The phenomenon of routers with public IP addresses appearing in Shodan search results.
- A simple example is a PPTP service exposed on TCP port 1723 and detectable from the Internet.
- It is important to clarify that appearing in Shodan search results does not automatically mean that the router has been hacked or compromised.
- However, the presence of such an exposed service indicates that the router has an Internet-facing attack surface.
* The objectives of this article are to:
- Understand why PPTP can be detected from the Internet.
- Understand the risks associated with service exposure.
- Perform a basic security audit.
- Apply basic hardening measures.
***“A router doesn't have to be compromised to become interesting. Sometimes, being publicly visible is already the first thing worth investigating."***
2. What Is PPTP and Why Is It Exposed?
* Brief Explanation of PPTP
PPTP (Point-to-Point Tunneling Protocol) is a VPN protocol used to establish an encrypted tunnel between a client and a remote server over a network such as the Internet. It was widely used in the past for remote access and VPN connections. PPTP typically uses TCP port 1723 for control connections and GRE (Generic Routing Encapsulation) to carry tunneled traffic.
However, PPTP is now considered obsolete and insecure because it has well known security weaknesses. For modern VPN deployments, more secure alternatives such as WireGuard, OpenVPN, or IPsec/IKEv2 are generally recommended ^_^
* The basic architecture is:
- TCP/1723 is used for the control connection.
- GRE (Generic Routing Encapsulation) is used to carry the tunneled traffic.
Internet <> Public IP <> Router/firewall <> PPTP Server. (and nue was here ;) )
- The PPTP server is enabled on the router.
- The firewall allows incoming connections from the WAN.
- The router has a public IP address or port forwarding is configured.
- As a result, the service can be accessed from the Internet.
3. How Shodan Detects PPTP ?!! OMG >..<
* Shodan as an Internet-Wide Scanner
Port Discovery
V
Service Detection
V
Protocol Fingerprinting
V
Banner / Metadata
V
Indexed Result
* TCP/1723 as a PPTP Indicator
- The PPTP control connection uses TCP port 1723.
- If this port is accessible from the Internet, scanners can detect the service.
- Shodan can classify the service as PPTP based on the protocol’s characteristics.
* Protocol Fingerprinting
Shodan ---(internet scan)---> Public IP ---> TCP/1723 ---> PPTP Service ---> Protocol Fingerprint ---> "pptp" identified" UUUUWWOWW GOTCHAA ^_^
* What Shodan Visibility Actually Means
- Detected <> compromised
- Open port <> authenticated access
- Internet exposure = attack surface
4. Assessing the Risk of Exposed PPTP
* Why PPTP Is Considered Legacy
- PPTP is an older-generation VPN technology.
- It has historical security weaknesses in both its protocol design and implementations.
- PPTP is not as secure as modern VPN technologies.
* Exposure vs. Vulnerability
Condition <> Meaning
Open port <> The service is reachable.
Identified service <> The protocol can be identified.
Vulnerable service <> The service has a weakness that can potentially be exploited.
Compromised <> The system has been successfully taken over.
***Exposure is an indicator that an assessment should be conducted, not proof of compromise.***
* Potential Attack Surface
- unwanted connection attempts
- password-guessing/authentication attacks
- exploitation | vulnerability implemen router
- legacy protocol risks
- information disclosure service fingerprinting
5. Performing a Basic Exposure Audit
* Check the Router Configuration
- Is the PPTP server actually required?
- Is PPTP enabled on the WAN interface?
- Is remote access required?
- Does the firewall allow TCP/1723 connections from the Internet?
- Is there a firewall rule that allows GRE traffic?
- Is there any port forwarding configured for PPTP?
* Check from an External Perspective
Internal Configuration + External Visibility = Actual Exposure
* Review Shodan Results
If an organization’s own IP address appears in Shodan:
- Validate that the IP address belongs to the organization or the relevant device.
- Identify the exposed services.
- Document the exposed ports and services.
- Do not immediately conclude that the system has been compromised.
6. Basic Hardening From Exposed to Secure
* Disable PPTP If It Is Not Needed
*** This is more effective than simply trying to make the service “invisible” to scanners.***
* Replace PPTP With a Modern VPN
The choice of VPN should take into consideration:
- security
- compatibility
- authentication
- device support
- maintenance
* Restrict WAN Access
If PPTP must remain in use:
Internet ---> Firewall ---> Trusted Source → Allow | Unknown Source → Deny
***Allow only what is necessary.***
access based on:
- source IP
- source network
- VPN management network
- firewall policy
* Review Firewall Rules
Audit rule:
- TCP/1723
- GRE
- WAN > router
- port forwarding
- remote management
rule: ANY > Router > Allow
* Disable Unnecessary Services
Don’t stop at PPTP.
Also audit:
- Telnet
- HTTP management
- SSH WAN
- SNMP
- FTP
- UPnP
- service legacy
***If you don't need it, disable it.***
7. Configuration Example
Before
WAN
|---> TCP/1723 > ALLOW
|---> GRE > ALLOW
|---> Remote Management > ALLOW
After
WAN
|---> TCP/1723 > DENY
|---> GRE > DENY
|---> Remote Management > DENY
***Actual configurations vary across MikroTik, Cisco, OpenWrt, pfSense, FortiGate, and other vendors.***
8. Verify the Hardening
* Local Verification
- The PPTP server has been disabled if it is not required.
- The firewall rules have been updated.
- Remote management is not exposed to the WAN.
* External Verification
- Before
Internet > TCP/1723 > Router
- After
Internet > TCP/1723 > Router
* Recheck Shodan
If a service was previously indexed, configuration changes are not always reflected immediately in Shodan’s index.
Current network exposure <> Historical Shodan data
- This is a good point to include in the article because readers often assume that if the Shodan result is still visible, the configuration change was unsuccessful.
9 Hardening Checklist
- Verify whether PPTP is actually required.
- Disable PPTP if it is no longer needed.
- Prefer a modern VPN protocol.
- Restrict WAN access using firewall policies.
- Review TCP/1723 exposure.
- Review GRE-related firewall rules.
- Disable unnecessary WAN services.
- Restrict router management access.
- Update router firmware.
- Verify exposure externally.
- Recheck Shodan after remediation.
10. Conclusion Visibility is a Security Signal
***Being visible on Shodan is not the same as being compromised. But unexpected visibility should always trigger an investigation.***
PPTP exposed > identify why > assess necessity > restrict/disable > replace legacy technology > verify.
Well Done, Well Noted ndan~
Shodan visibility is not the problem. Unnecessary exposure is. Being visible on Shodan does not necessarily mean that a router has been compromised. However, it is a clear indication that a service is reachable from the public Internet and therefore deserves attention. PPTP is a legacy VPN technology, and exposing it directly to the Internet can increase the routers attack surface. The right approach is not simply to make the service disappear from Shodan, but to understand why it is exposed, whether it is still needed, and whether the exposure can be safely reduced.
Hahaha alright, that’s a wrap for today’s article—my coffee’s gone, so that’s my cue to stop typing.
Let’s end this with a Bismillah at the start and an Alhamdulillah at the finish. Catch you next time, tech gembelers!.
./Nuenomaru
