Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I manage a weekly rental house that includes wireless Internet access. I've allowed all outbound ports on my router but my ISP has disabled my Internet access twice now because guests have downloaded (or served up) copyrighted content. So I'd like to institute some port filtering to discourage p2p sharing (see disclaimer below). But I don't want to inconvenience the 99.9% of folks who keep things above-board.

My question is, what outbound ports are typically open for rental/hotel wireless Internet access, or where can I find such a list? TCP 80,443,25,110 at a minimum. Though my own email service uses 995 and 465 for SSL, some may use IMAP, I personally use SSH and FTP, so I'll open those. Roughly I figure I need to open access to privileged ports, and close 1024 & above. Is there a whitelist I should institute for commonly used high ports? And does it make sense to block UDP > 1024 ?

Disclaimer: I realize anyone replying to this message could circumvent the port filtering and share content to their heart's content. I do not need comprehensive p2p blocking, which requires more than a port whitelist. Anyone staying at the house shoulders the responsibility for their Internet use, per the rental contract. Also anyone savvy enough to circumvent the port filters would hopefully be savvy enough to use some sort of peer blocking, thereby preventing the ISP from taking down the service.

share|improve this question
2  
Don't open port 25; use port 587 instead to support people who need to send email. –  Michael Hampton Sep 4 '12 at 1:32
    
In my experience preventing P2P (specifically torrents) can be a bit tricky - one method I've found that was rather successful was throttling the bandwidth - if people can download their illegal content faster at Starbucks or McDonalds then they're likely to do that as opposed to at your property. –  DKNUCKLES Sep 4 '12 at 16:09

1 Answer 1

A general list of ports to open on "guest networks" which are relatively safe:

Outbound TCP:

53                  DNS unless you provide it (yes, TCP. Read the RFCs)
80, 443             Web Browsing
110, 995            EMail (pop3, pop3s)
143, 993            EMail (IMAP, IMAPS)
587                 EMail (SMTP Submission RFC 6409)

Outbound UDP:

53                  DNS again, unless you provide it
123                 NTP (Optional, but nice.)

Inbound TCP/UDP: NONE (Only established stateful connections from the above list)

As others have mentioned, bandwidth throttling may be a more effective way of dealing with torrenters.


As a non-technical measure to protect yourself from action (by your ISP or by copyright holders) you should also provide your renters with an acceptable internet use policy, noting that the renter's use of the internet access is their sole responsibility, illegal activity is not tolerated, and that violations of that policy will result in loss of internet access on this and all future visits.

There are template AUPs, but yours can be as simple or complex as you want, I recommend getting it down to one side of a regular sheet of paper.

share|improve this answer
    
I personally love to see some support for remote connections - ideally RDP (3389) and SSH (22), though it's not something I generally expect. Might have the benefit of letting people do their copyright violations by remotely controlling a system at home, instead of using the rental pipe for that too. Maybe. –  HopelessN00b Sep 5 '12 at 3:30
    
Thanks voretaq7, that's just was I was looking for. –  Steve Sep 6 '12 at 18:43
    
@HopelessN00b that has to be counterbalanced against the possibility that someone will use your network as an attack platform though (I might allow it in this case since you know who the renters are and presumably have a password or other access control on the network. Probably not something I'd allow on a wide-open guest WiFi though...) –  voretaq7 Sep 6 '12 at 19:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.