Home | Security basics by Doug Brown

Ports and Firewalls

What is a Port?

A port is an address associated with a program or process on a computer. There are 2^16 (0 - 65,535) ports available on each computer. The first 1024 ports are know as the "registered ports" and often function as the server side of common applications. For example port 21 is commonly an FTP server, and port 80 is commonly a web server. The ports above 1024 are known as the "ephemeral ports." While they can be used for some server programs, they are most often dynamic ports that client systems use. If you were to connect to www.unc.edu the traffic would orginate from an ephemeral port on your system such as port 4361 and connect to port 80 on the web server. The port when combined with the system's IP Address, is a completely unique identifier like a telephone number; there is only one www.unc.edu in the world - it is 152.2.1.217:80 - [IP Address]:[Port].

What does a firewall do?

A firewall is a device that controls network traffic. Generally a firewall is configured to block certain inbound ports directed at your local network, but to allow most outbound traffic to travel to the Internet. Holes or conduits are opened through the firewall to allow access to systems on your local network like your web server. In a "stateful" configuration, the firewall remembers the context of connections and continuously updates this state information in dynamic connection tables. A firewall is not a panacea to solve all of your security problems; invariably you will open ports through your firewall to allow access to local machines. If one of the local machines is compromised, then the firewall is no longer relevant.

How is a router filter different from a firewall?

A router is not as intelligent as a stateful firewall, and can not replace a firewall in your security model. Because of the handshake in TCP traffic filters on a routers will effectively block traffic in both directions. Router filters are very useful for blocking ports that you would never want open and blocking spoofed and private IP addresses (outlined in RFC 1918.) Blocking ports in a University environment can often be a battle with the user community, but the following table shows some minimal ports that you may want to consider blocking on your border router:
Port:      Service:
1 TCPMux
5 RJE
7 echo
9 discard
11 systat
13 daytime
17 qotd
18 msp
19 chargen
69 TFTP
135 DCE (NetBIOS)
137 NS (NetBIOS)
139 Session (NetBIOS)
445 DS (NetBIOS)
12345 Netbus (Trojan)
27374 Sub-7 (Trojan)
31337 Back Orifice (Trojan)
31338 Back Orifice (Trojan)
65000 Stacheldraht (Trojan)


The following incoming access list will block these ports on your router:

deny tcp any any eq 1
deny udp any any eq 1
deny tcp any any eq 5
deny udp any any eq 5
deny tcp any any eq 7
deny udp any any eq 7
deny tcp any any eq 9
deny udp any any eq 9
deny tcp any any eq 11
deny udp any any eq 11
deny tcp any any eq 13
deny udp any any eq 13
deny tcp any any eq 17
deny udp any any eq 17
deny tcp any any eq 18
deny udp any any eq 18
deny tcp any any eq 19
deny udp any any eq 19
deny tcp any any eq 69
deny udp any any eq 69
deny tcp any any eq 135
deny udp any any eq 135
deny tcp any any eq 137
deny udp any any eq 137
deny tcp any any eq 139
deny udp any any eq 139
deny tcp any any eq 445
deny udp any any eq 445
deny tcp any any eq 12345
deny udp any any eq 12345
deny tcp any any eq 27374
deny udp any any eq 27374
deny tcp any any eq 31337
deny udp any any eq 31337
deny tcp any any eq 31338
deny udp any any eq 31338
deny tcp any any eq 65000
deny udp any any eq 65000

To block spoofed and private IP Address you will want an access list similar to the following; this example assumes your IP Address space is the class 'B' subnet 152.2.0.0/16:

Incoming Access List:

deny ip 152.2.0.0 0.0.255.255 any (Blocks spoofing your of IP Addresses)
deny ip 10.0.0.0 0.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip any 10.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 127.0.0.0 0.255.255.255
permit ip any any (anchor statement to allow legitmate access to your network)

Outgoing Access List:

deny ip 10.0.0.0 0.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip any 10.0.0.0 0.255.255.255
deny ip any 127.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 192.168.0.0 0.0.255.255
permit ip 152.2.0.0 0.0.255.255 any (Allows your IP Address to access the Internet)


I hope you found this information helpful -Doug Brown