0

First, bear in mind that I'm not a system administrator; I just have a general question that's been bugging me for years.

I often hear of the benefits of a firewall blocking certain ports to "increase security". At the same time, there are some ports that are usually left open (e.g. port 80).

I liken this situation to having a fortress with many doors, but you lock some of the doors to prevent intruders. That's well and good, but what good is it if you still leave some of the doors open? If the intruder is some deadly virus, then what's the difference between leaving 1 door open versus 1000?

It seems like I have some fundamental misunderstanding of how networks are attacked and/or protected.

2 Answers 2

2

I often hear of the benefits of a firewall blocking certain ports to "increase security". At the same time, there are some ports that are usually left open (e.g. port 80).

On firewalls you will almost always block all incoming traffic by default except for traffic destined for a specific service.

If you don't have a strong requirement for security you will just permit outgoing traffic on any port.

If you need to be a bit more secure you will block outgoing traffic to commonly abused ports. For example you would block outgoing SMTP, except from your mailserver to prevent your internal systems from becoming a source of SPAM.

As you grow even more paranoid, you will not permit any direct outbound access, and you will force all traffic through application level firewalls that are able to dig deeper into the payload then what you get with just a basic packet filter. For HTTP traffic you would use a HTTP proxy like Squid. For DNS, you might run your local DNS caching server instead of permitting direct access to external DNS servers. The list goes on. Almost every common server has a application level proxy of some sort. This means you don't need to open 'port 80' irrespective of whatever protocol some client chooses to use on port 80. Instead you permit HTTP/HTTPS traffic from your clients to connect to port 80/443, and you prohibit everything else.

Also, understand that your network has to fulfill its purpose. This always means that there will be some sort of compromise between extremely paranoid security, and making things actually work for your users.

2
  • Thanks, I think that's the key point that I was missing: you're not just allowing any traffic through a port; you're only allowing certain types of traffic.
    – vargonian
    Aug 6, 2013 at 6:12
  • @vargonian but, you can filter any type of traffic through any port. The port does not dictate what kind of traffic goes through it. I could use port 12345 for HTTP if I wanted to Jan 4, 2017 at 1:09
0

In a firewall you normally only let the ports open that are needed.

E.g. you leave port 80 open because you want to serve web pages or you leave port 22 open to serve ssh connections.

This ports must be left open because else you could not provide this services.

On the other side all ports that are not in use should be closed. So an attacker does not have the probability to use this port to intrude your system with this port.

When you leave this ports open and forget to stop the service belonging to this (or a malicious program opens this port) then there is an attack vector. If the port is closed in the firewall it does not matter that there is a program listening on that port as the firewall blocks the traffic before it reaches the service.

E.g. if your server runs a telnet service and port 23 is closed then nobody can reach it and attack your server through the telnet service. If you leave the port open then anybody can reach the trelnet service and try to intrude your system.

So you only leave ports open that are needed to fullfil your specific needs whereas all other ports are closed and could not do any harm.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .