Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have router with public IP addres. What security breach (if any) am I creating by forwarding large port range (high port numbers only - above 50000) to one of computers inside network. All ports on destination computer are closed most of the time.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The common practice is to forward only required ports because it protects from accidentally installed application that for some reason listens on those ports and from malware which may infiltrate to your system and use those ports. I.e. it's actually for just-in-case.

If you know that ports are closed and will remain closed, there's really no real security threat.

Paranoia considered a healthy practice in today internet, yet we should know that it isn't the only option.

share|improve this answer

The more ports you allow, the more you risk a random/bad software using one of those ports and accepting random 'public' connection. You should only accept incoming connection (and forward them) for knowns services and applications.

Depending on your router/firewall, you might want to look into connection tracker (conntrack).

share|improve this answer
    
Even if I'm sure that all ports on destination computer are closed? I'm manually starting services on that ports and close it just after I use it... –  pbm Dec 13 '11 at 6:28
    
Point is that you should never 'trust' the remote system. Even if you are managing it and manually opening and closing the ports yourself. If you get a trojan horse, remote system could connect way too easily. This is one of the reason why system administrator doesn't always have direct access to firewall (to prevent that kind of 'anyway, my server will never have virus' mindset). –  CloudWeavers Dec 13 '11 at 6:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.