Home > Ask the Security Experts > Network Security Questions & Answers > How do we create a restrictive ruleset to manage our TCP ports?
Ask The Security Expert: Questions & Answers
EMAIL THIS

How do we create a restrictive ruleset to manage our TCP ports?

Mike Chapple, featured expert EXPERT RESPONSE FROM: Mike Chapple, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 16 August 2006
I have inherited a rule set from a previous hierarchy and there's a rule I'm not happy with. I want to remove it and replace it with a rule that is more restrictive, but after checking my outgoing TCP services, I found so many random TCP ports that I'm not sure how to be restrictive. Do you have any suggestions besides the obvious (block all ports and wait for the phone to ring)?

>
The "random" ports you've found are a result of how TCP connections work. The client initiating the connection uses a well-known port for the destination port (e.g. port 80 for HTTP traffic) and then uses a random high-numbered port for the source port. When the server replies, this situation is reversed. In this example, the source port would be port 80 and the destination port would be the high-numbered port.

You didn't mention the type of firewall you use. Assuming it's a modern stateful inspection firewall, you don't need to worry about the high-numbered ports. If you want to allow Web traffic from the internal network out to the Internet, you simply need to allow port 80 traffic outbound. The firewall will recognize and handle the traffic for the related high-numbered port used by each connection.

More on network security :

  • Visit our TCP/IP resource center and learn how to maintain secure Internet connections to transfer data between two familiar networks.
  • Learn how stateful inspection firewalls and proxy firewalls differ.


  • BROWSE BY TAG
    Network Security,   Network Security: Tools, Products, Software,   Network Firewalls, Routers and Switches,   Enterprise Network Security,   Network Protocols and Security,   VIEW ALL TAGS

    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



    RELATED CONTENT
    Network Security
    How to set up a split-tunnel VPN in Windows Vista
    What is the difference between static and dynamic network validation?
    Port scan attack prevention best practices
    Securing the intranet with remote access VPN security
    How to prevent network sniffing and eavesdropping
    How to implement virtual firewalls in a complex network infrastructure
    How to manage network bandwidth with distributed ISP bandwidth
    How to edit group policy objects to give a user local admin rights
    How to prevent operating system cloning with AES 256-bit encryption
    How to securely connect a LAN POS to a remote point-of-sale device

    Network Firewalls, Routers and Switches
    Best Network Firewall Products
    What is the difference between static and dynamic network validation?
    Screencast: Smoothwall offers firewall defense in lean times
    New Cisco IOS bugs pose tempting targets, says Black Hat researcher
    How to implement virtual firewalls in a complex network infrastructure
    How to manage network bandwidth with distributed ISP bandwidth
    Firewall rule management best practices
    Should enterprises be running multiple firewalls?
    What are the disadvantages of proxy-based firewalls?
    IT pros find corporate firewall rules tough to navigate

    Network Protocols and Security
    Expert calls SSL protocol vulnerability a non issue
    How to prevent phishing attacks with social engineering tests
    How SSL-encrypted Web connections are intercepted
    DNSSEC deployment challenges can be overcome
    Microsoft issues SMB vulnerability advisory, patch pending
    Microsoft repairs Windows media, TCP/IP vulnerabilities
    How to test IPv6 infrastructures
    DNSSEC deployments gain momentum since Kaminsky DNS bug
    Kaminsky interview: DNSSEC addresses cross-organizational trust and security
    How to create secure Windows FTP automation

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    bastion host  (SearchSecurity.com)
    firewall  (SearchSecurity.com)
    Firewall Builder  (SearchSecurity.com)
    screened subnet  (SearchSecurity.com)
    virus  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts