Hey all,

I’m trying to understand something odd I’m seeing on my new TP-Link router.
An nmap scan against my WAN IP consistently shows 20001/tcp as open. From what I can tell, this is normally associated with the TP-Link Tether app and cloud-management features.

The strange part:
I have remote management disabled
The Tether app and all TP-Link cloud / remote features disabled
No port forwarding rules involving that port
UPnP is off

Yet nmap still reports 20001/tcp open.

Not shown: 65534 filtered tcp ports (no-response)
PORT      STATE  SERVICE
20001/tcp closed microsan
Host is up (0.0058s latency).

Not shown: 65534 open|filtered udp ports (no-response)
PORT   STATE  SERVICE
68/udp closed dhcpc

As another test, I tried hitting the port from outside my network using:
telnet <my_external_ip> 20001 and shows 'Connection refused'

Since this is a network I've set up for my parents after their aging router has finally died I want a good and secure setup with minimal maintenance. 

Is this some kind of TP-Link pseudo-service, a firewall rule quirk, or maybe a misleading nmap result?
Thanks all :)