I manage a weekly rental house that includes wireless Internet access. I've allowed all outbound ports on my router but my ISP has disabled my Internet access twice now because guests have downloaded (or served up) copyrighted content. So I'd like to institute some port filtering to discourage p2p sharing (see disclaimer below). But I don't want to inconvenience the 99.9% of folks who keep things above-board.

My question is, what outbound ports are typically open for rental/hotel wireless Internet access, or where can I find such a list? TCP 80,443,25,110 at a minimum. Though my own email service uses 995 and 465 for SSL, some may use IMAP, I personally use SSH and FTP, so I'll open those. Roughly I figure I need to open access to privileged ports, and close 1024 & above. Is there a whitelist I should institute for commonly used high ports? And does it make sense to block UDP > 1024 ?

Disclaimer: I realize anyone replying to this message could circumvent the port filtering and share content to their heart's content. I do not need comprehensive p2p blocking, which requires more than a port whitelist. Anyone staying at the house shoulders the responsibility for their Internet use, per the rental contract. Also anyone savvy enough to circumvent the port filters would hopefully be savvy enough to use some sort of peer blocking, thereby preventing the ISP from taking down the service.

  • 3
    Don't open port 25; use port 587 instead to support people who need to send email. – Michael Hampton Sep 4 '12 at 1:32
  • In my experience preventing P2P (specifically torrents) can be a bit tricky - one method I've found that was rather successful was throttling the bandwidth - if people can download their illegal content faster at Starbucks or McDonalds then they're likely to do that as opposed to at your property. – DKNUCKLES Sep 4 '12 at 16:09

A general list of ports to open on "guest networks" which are relatively safe:

Outbound TCP:

53                  DNS unless you provide it (yes, TCP. Read the RFCs)
80, 443             Web Browsing
110, 995            EMail (pop3, pop3s)
143, 993            EMail (IMAP, IMAPS)
587                 EMail (SMTP Submission RFC 6409)

Outbound UDP:

53                  DNS again, unless you provide it
123                 NTP (Optional, but nice.)

Inbound TCP/UDP: NONE (Only established stateful connections from the above list)

As others have mentioned, bandwidth throttling may be a more effective way of dealing with torrenters.

As a non-technical measure to protect yourself from action (by your ISP or by copyright holders) you should also provide your renters with an acceptable internet use policy, noting that the renter's use of the internet access is their sole responsibility, illegal activity is not tolerated, and that violations of that policy will result in loss of internet access on this and all future visits.

There are template AUPs, but yours can be as simple or complex as you want, I recommend getting it down to one side of a regular sheet of paper.

| improve this answer | |
  • I personally love to see some support for remote connections - ideally RDP (3389) and SSH (22), though it's not something I generally expect. Might have the benefit of letting people do their copyright violations by remotely controlling a system at home, instead of using the rental pipe for that too. Maybe. – HopelessN00b Sep 5 '12 at 3:30
  • @HopelessN00b that has to be counterbalanced against the possibility that someone will use your network as an attack platform though (I might allow it in this case since you know who the renters are and presumably have a password or other access control on the network. Probably not something I'd allow on a wide-open guest WiFi though...) – voretaq7 Sep 6 '12 at 19:17

First off, an understanding of services needed should be obtained. I know this is a royal pain, but a guest ACL should only allow traffic to resources that are trusted by your organization.

First, destination addresses are easily found by performing a "Arin who is" search. (American registry of internet numbers.)

Second, legitimate internet resources will provide a list of TCP/UDP ports used for their sites/services . Block all other ports.

Third, block all untrusted resources such as: All of Asia, Europe, Africa, South America, TOR exit points and other anonymous proxy services. APNIC, RIPE, AFRINIC, LACNIC. (Google search) (I provide security for USA based companies with no ties outside the USA. This may not apply to you)

https://www.dan.me.uk/tornodes has a list of TOR exit points. Other proxy services you will need to research on your own.

Fourth. Use better network equipment that supports UTM, IDP, layer7 application firewall, and other threat detection technologies.

I use Juniper SRX but there are other similar products and services from multiple vendors.

If not satisfied, consider a cloud based security solution from a reputable company who can handle security for you.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.