DCCP, H.323, IRC, PPTP, RTSP, SCTP, SIP, TFTP, and UPDLite Service Ports

Hello there,

I would like to ask your knowledge or experience on all these service ports on Mikrotik. As It all is on in my mikrotik router. So, what advantages and disadvantages if i close all these ports in the Mikrotik router now? Please explain each ones thanks in advance.

It depends on what your Mikrotik is used for. If you do not use any of those protocols across NAT (i.e. your LAN side clients do not use them to connect to servers in the internet nor vice versa), it is OK to disable all of them. PPTP is an exception in terms that even if you do not use PPTP as such but you do use GRE, enabling the service port for PPTP prevents the firewall from flagging perfectly legitimate GRE packets with connection-state=invalid. And SIP is an exception in terms that even if you use it, in some scenarios, you may get better results with SIP service port disabled than enabled.

Other than that, the service-port row is just an information for the connection tracking to use a corresponding “NAT helper” for each of these protocols - enabling a service-port row does not make the Mikrotik itself listen on the corresponding port, nor does it make it forward incoming traffic towards that port anywhere. But it does prevent it from opening additional pinholes based on information contained in those protocols (at least SIP, FTP, and TFTP all use a control session established via a “well-known” port to organize “data transport” sessions via other ports, which is why the NAT helper is necessary if NAT is involved.). But the helpers are only activated if the firewall rules permit access to those “well known” ports/protocols and/or if the corresponding services are enabled on the Mikrotik itself (but it seems to me this is only relevant for PPTP).