@ADIT 

Did you use the local Nmap to scan? The link you sent seems to be an online scan. I did not click any external links.

What is the screenshot result like for the scan? Is it filtered or open?

Do you use a controller to control them? 

Please mosaic your sensitive information. Here is a list of information considered sensitive:

1. Public IP address on your WAN if your WAN is.

2. Real MAC address of your device.

3. Your personal information including address, domain name, and credentials.

For troubleshooting purposes, when a WAN IP is needed, please leave some values visible for identification.

  @Clive_A 

pentest is an oniline scan tool.

nmap

ER605 settings:

These are managed via the web interface.  No controller is connected to the routers.

They say both, open|filtered, as seen in the screenshots.

  @ADIT 

ADIT wrote

  @Clive_A 

 

pentest is an oniline scan tool.

 

 

nmap

 

 

ER605 settings:

 

 

These are managed via the web interface.  No controller is connected to the routers.

 

 

They say both, open|filtered, as seen in the screenshots.

 

Don't mosaic everything. Can you show me your WAN from the router and the Nmap IP? Are they the same IP address?

 I just hit all my routers with an nmap scan on their public wan IP targeting UDP ports 1-2000 

My 2 ER605's running 2.3.0 and my ER8411 running 1.3.2 all only reported UDP 500 open (expected as used for vpns)

The final report generated for each router (udp scan only tdue to time constraints) looked like this

Im not super happy that these ports are open-filtered rather that just full unresponsive, but none of them are reporting udp 1900 as open at all.

All routers are in controller mode

  @Clive_A 

Yes, both are pointed to the same Public IP Address on the WAN.  You can see the reverse lookup maps to Verizon FIOS, hence the Public IP.

The screenshots I have were masked and saved. 

  @GRL 

I believe there were 3 revision dates of the ER605 2.3.0 firmware prior to release.  Mine is listed in the OP.

None are on a Controller. 

On a full scan they do show other ports open but since my first issue was a PCI Compliance Scan it only had questions about the IPSec (I have VPNs) and UPnP (it is supposedly disabled) ports.

I also have a problem with the "open|filtered" status of the ports.  If the service is disabled they shouldn't report at all.

If it is Open and Filtered, where can I view the filters?  This could lead one to think that this device is a Backdoor heaven.

  @ADIT 

My 605s are the same firmware revision as yours, which is the final official release of 2.3.0