OSX mDNSResponder opening all ports on Billion via uPnP

I recently swapped my router for a Billion 7800VDOX, and noticed some attempted connections to my iMac from exteal addresses. On investigation I found that a uPnP port had been opened on the router with port range 0-0 (inteal and exteal.) This has the effect, verified with an exteal port scanner, of opening ALL port numbers on the router and directing them to the iMac. I deleted the mapping and ran Wireshark and captured an exteal address request at the same time as the mapping was restored.

490 422.077544  192.168.1.131   192.168.1.254   NAT-PMP 44  Exteal Address Request

This was followed by a SOAP request to get the exteal IP address of the router. Checking the source port (5353) with lsof I found it owned by mDMSResponder.

My assumption as to what is happening is that mDMSResponder is using uPnP just to get the exteal IP address of the router, and doing so using a supposedly harmless request to map port 0, which should be an invalid port. However the Billion router is treating this as, either by design or programming error, as a request to open all ports.

Anyone have any other suggestions?

Recent Questions...