1

I have router with public IP addres. What security breach (if any) am I creating by forwarding large port range (high port numbers only - above 50000) to one of computers inside network. All ports on destination computer are closed most of the time.

2 Answers 2

2

The common practice is to forward only required ports because it protects from accidentally installed application that for some reason listens on those ports and from malware which may infiltrate to your system and use those ports. I.e. it's actually for just-in-case.

If you know that ports are closed and will remain closed, there's really no real security threat.

Paranoia considered a healthy practice in today internet, yet we should know that it isn't the only option.

0

The more ports you allow, the more you risk a random/bad software using one of those ports and accepting random 'public' connection. You should only accept incoming connection (and forward them) for knowns services and applications.

Depending on your router/firewall, you might want to look into connection tracker (conntrack).

2
  • Even if I'm sure that all ports on destination computer are closed? I'm manually starting services on that ports and close it just after I use it...
    – pbm
    Dec 13, 2011 at 6:28
  • Point is that you should never 'trust' the remote system. Even if you are managing it and manually opening and closing the ports yourself. If you get a trojan horse, remote system could connect way too easily. This is one of the reason why system administrator doesn't always have direct access to firewall (to prevent that kind of 'anyway, my server will never have virus' mindset). Dec 13, 2011 at 6:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .