How do we create a restrictive ruleset to manage our TCP ports?
I have inherited a rule set from a previous hierarchy and there's a rule I'm not happy with. I want to remove it and replace it with a rule that is more restrictive, but after checking my outgoing TCP services, I found so many random TCP ports that I'm not sure how to be restrictive. Do you have any suggestions besides the obvious (block all ports and wait for the phone to ring)?
The "random" ports you've found are a result of how TCP
connections work. The client initiating the connection uses a well-known port for the destination port (e.g. port 80
traffic) and then uses a random high-numbered port for the source port. When the server replies, this situation is reversed. In this example, the source port would be port 80 and the destination port would be the high-numbered port.
You didn't mention the type of firewall you use. Assuming it's a modern stateful inspection firewall, you don't need to worry about the high-numbered ports. If you want to allow Web traffic from the internal network out to the Internet, you simply need to allow port 80 traffic outbound. The firewall will recognize and handle the traffic for the related high-numbered port used by each connection.
More on network security :
Visit our TCP/IP resource center and learn how to maintain secure Internet connections to transfer data between two familiar networks.
Learn how stateful inspection firewalls and proxy firewalls differ.
This was first published in August 2006