Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What are some ports that can NEVER be blocked outbound in firewalls, as doing so will stop basic internet use? Some I can think of are: port 53 udp/tcp -- dns, blocking this will prevent users accessing any domain port 80 tcp - http port 443 tcp - https Are these all, and are these ports ALWAYS accessible outbound on every host connected to the internet?

share|improve this question

4 Answers 4

There are no ports that need to be opened for full access in your outbound firewall rules.

Why? Because by proxying requests we can achieve the same thing, except with more control.

The three most common:

  • HTTP proxy (so you can close port 80 and 443)
  • Internal DNS servers (proxy requests to the outside world)
  • Internal Mail server (relays incoming and outgoing mail to the world)

Then you simply setup your firewall to allow connections from the IPs associated with the machines running these services ONLY.

Basically, it's a subjective question with no real right answer.

share|improve this answer

Wow, this is a question that has a somewhat broad and complicated answer.

  1. Hosts are not typically connected "directly" to the internet. They usually sit behind a firewall\router of some sort.

  2. Outbound ports are not open on a host unless the host has an active connection to another host.

  3. Hosts don't connect FROM port 80, port 443, etc. they connect TO port 80, port 443, etc.

  4. The ports you referenced are inbound ports on the destination host. the outbound port on the source host is a random port, selected from the ephemeral port range.

  5. You technically don't need to open any outbound ports on your firewall. If you wanted to isolate your network from the internet you would block all outgoing traffic.

  6. Firewalls usually have what's called an "ANY ANY" rule for outbound traffic, meaning any outbound traffic coming in to the internal interface of the firewall (local LAN) is not restricted and the return traffic is not restricted.

  7. Web servers listen for INCOMING connections on port 80. DNS servers listen for INCOMING connections on port 53, etc. These are inbound ports, not outbound ports.

share|improve this answer
    
Yes I mean the ports on the remote server being connected to. By basic internet use I mean surfing http/https sites on the internet (not just local network). Ports 80 and 443 obviously must be open, and port 53 as well for dns. This means that for anyone able to do basic internet surfing, they can connect to my server on ports 53/80/443. Is this correct? I know most firewalls allow outbound, but some wireless hotspots/hotels/etc block port 25/games/p2p/im/vpn/icmp/everything except websurfing and I want to know which ports are always allowed. –  David Wu Nov 19 '09 at 0:05
    
and port 53 udp, I know udp isn't connection-based like tcp, but they can still send/recieve udp traffic to a external server on port 53. Is this correct? –  David Wu Nov 19 '09 at 0:06

Define what you mean by basic internet services, such as imap, imaps, dns, smtp, https...

egrep '(your|list|items|here)' /etc/services | awk '{print $2}'

Those ports.

It is impossible to say anything about "every host connected to the internet," although I would imagine the vast majority of consumers have all these open, but corporate users might be shuffled behind a proxy, firewalled off completely, etc. Same goes for servers.

share|improve this answer

It is worth noting that ports do not have to be fully open or closed. A firewall might allow the standard DNS related ports through only to local DNS servers for instance, or a transparent proxy may capture connections and only forward the on to the final destination if the protocol is right (this could, for instance, stop you using port 80 for outgoing P2P connections without blocking normal HTTP traffic - though it would not on its own stop you trying to use a HTTP->P2P proxy).

You can not guarantee any port will be open, or if you find it to be open in some cases it may not be open to all communication attempts even from the same location.

Ubiquitous as HTTP is, it is not entirely impossible that you will find environments where HTTP(S) is not permitted but other protocols are.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.