Q

How do we create a restrictive ruleset to manage our TCP ports?

Learn how implementing stateful inspection firewalls can help network administrators keep tabs on TCP connections in this network security Ask the Expert Q&A.

This Content Component encountered an error
I have inherited a rule set from a previous hierarchy and there's a rule I'm not happy with. I want to remove it and replace it with a rule that is more restrictive, but after checking my outgoing TCP services, I found so many random TCP ports that I'm not sure how to be restrictive. Do you have any suggestions besides the obvious (block all ports and wait for the phone to ring)?
The "random" ports you've found are a result of how TCP connections work. The client initiating the connection uses a well-known port for the destination port (e.g. port 80 for HTTP traffic) and then uses a random high-numbered port for the source port. When the server replies, this situation is reversed. In this example, the source port would be port 80 and the destination port would be the high-numbered port.

You didn't mention the type of firewall you use. Assuming it's a modern stateful inspection firewall, you don't need to worry about the high-numbered ports. If you want to allow Web traffic from the internal network out to the Internet, you simply need to allow port 80 traffic outbound. The firewall will recognize and handle the traffic for the related high-numbered port used by each connection.

More on network security :

  • Visit our TCP/IP resource center and learn how to maintain secure Internet connections to transfer data between two familiar networks.
  • Learn how stateful inspection firewalls and proxy firewalls differ.
  • This was first published in August 2006

    Dig deeper on Network Firewalls, Routers and Switches

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    -ADS BY GOOGLE

    SearchCloudSecurity

    SearchNetworking

    SearchCIO

    SearchConsumerization

    SearchEnterpriseDesktop

    SearchCloudComputing

    ComputerWeekly

    Close