Manage Learn to apply best practices and optimize your operations.

How do we create a restrictive ruleset to manage our TCP ports?

Learn how implementing stateful inspection firewalls can help network administrators keep tabs on TCP connections in this network security Ask the Expert Q&A.

I have inherited a rule set from a previous hierarchy and there's a rule I'm not happy with. I want to remove it and replace it with a rule that is more restrictive, but after checking my outgoing TCP services, I found so many random TCP ports that I'm not sure how to be restrictive. Do you have any suggestions besides the obvious (block all ports and wait for the phone to ring)?
The "random" ports you've found are a result of how TCP connections work. The client initiating the connection uses a well-known port for the destination port (e.g. port 80 for HTTP traffic) and then uses a random high-numbered port for the source port. When the server replies, this situation is reversed. In this example, the source port would be port 80 and the destination port would be the high-numbered port.

You didn't mention the type of firewall you use. Assuming it's a modern stateful inspection firewall, you don't need to worry about the high-numbered ports. If you want to allow Web traffic from the internal network out to the Internet, you simply need to allow port 80 traffic outbound. The firewall will recognize and handle the traffic for the related high-numbered port used by each connection.

More on network security :

  • Visit our TCP/IP resource center and learn how to maintain secure Internet connections to transfer data between two familiar networks.
  • Learn how stateful inspection firewalls and proxy firewalls differ.
  • This was last published in August 2006

    Dig Deeper on Network device security: Appliances, firewalls and switches

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    Start the conversation

    Send me notifications when other members comment.

    Please create a username to comment.