Services and ports
This page lists everything a RouDem unit listens for on its network interfaces as delivered. It serves LAC-BCOP-1 FR-01, IR-01 and FR-10 and CRA Annex I 3(i) (minimised attack surface).
Summary
Section titled “Summary”- On the LAN (wired LAN port and Wi-Fi): the web interface, DNS and DHCP for the devices behind the unit, and SSH for on-site service.
- On the cellular side: nothing. No service accepts connections from the mobile network, and the firewall rejects inbound traffic. Everything the unit exchanges with MiWire is an outbound connection started by the unit; see Communications.
- Off by default: the SNMP agent. It is only switched on by MiWire support at the customer’s request.
What listens on the LAN
Section titled “What listens on the LAN”| Service | Port | Reachable from | Notes |
|---|---|---|---|
| Web interface (HTTPS) | 443/tcp | LAN only | The unit’s administration pages. Login required (admin, password from the label). The certificate is self-signed per unit; see First access. |
| Web interface (HTTP redirect) | 80/tcp | LAN only | Only redirects to HTTPS; no page is served over plain HTTP. |
| DNS | 53/udp, 53/tcp | LAN only | Resolves names for the devices behind the unit and forwards queries to the operator’s resolvers. Answers only queries from the LAN. DNSSEC validation markings from the upstream resolver are passed through unchanged. |
| DHCP (IPv4) | 67/udp | LAN only | Assigns addresses to the devices behind the unit. |
| DHCPv6 and router advertisements | 547/udp, ICMPv6 | LAN only | Assigns IPv6 addresses when the mobile network provides IPv6. |
| SSH | 22/tcp | LAN only | Used by MiWire for on-site service. No command-line access is offered to the customer; the customer’s administrative interface is the web interface. Authentication is by a per-unit password or by certificate; the password is not the one on the label. |
The web interface binds to the unit’s LAN IPv4 address and to the unit itself (localhost), not to the cellular address. DNS binds to the LAN bridge and localhost only.
Switched off or not present
Section titled “Switched off or not present”| Service | State | Notes |
|---|---|---|
| SNMP agent | Off by default | Installed but disabled. MiWire support can enable it at the customer’s request, for read-only monitoring from the customer’s LAN only. When enabled, it uses a community string or SNMPv3 user agreed with the customer, never a default community, and accepts queries from the LAN subnet only. The customer can switch it off again on the Services page. SNMP over the mobile network is not offered. |
| Telnet, FTP, TFTP | Not installed | |
| UPnP, SSDP, mDNS/Bonjour | Not installed | |
| SMB file sharing, SOCKS proxy | Not installed | |
| Bandwidth-test server (iperf and similar) | Not installed as a server | A speed-test client exists for support diagnostics, started on demand from the unit; nothing listens. |
| Second web server, netcat, packet capture and debugging tools | Not present in the production firmware | Development tools are left out of the firmware that ships on customer units. |
| NTP server | Off | The unit is an NTP client only; it does not serve time to the LAN. |
| VPN tunnels, IPv6 transition tunnels | None configured |
Support tunnel
Section titled “Support tunnel”For remote support the unit keeps an outbound, encrypted connection to a MiWire support relay. It is MiWire’s vendor support channel, not a customer VPN and not an interface of the mobile network operator; support logins are recorded in the security event log. It is listed with the other connections on Communications.
How to check
Section titled “How to check”From a computer on the LAN, a port scan of the unit’s LAN address shows ports 22, 53, 80 and 443 (and 161 only if SNMP has been enabled for you). From the internet, the unit’s cellular address answers nothing.