How do we create a restrictive ruleset to manage our TCP ports?

Ask the Expert

How do we create a restrictive ruleset to manage our TCP ports?

I have inherited a rule set from a previous hierarchy and there's a rule I'm not happy with. I want to remove it and replace it with a rule that is more restrictive, but after checking my outgoing TCP services, I found so many random TCP ports that I'm not sure how to be restrictive. Do you have any suggestions besides the obvious (block all ports and wait for the phone to ring)?

Continue Reading This Article

Enjoy this article as well as all of our content, including E-Guides, news, tips and more.

By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

Safe Harbor

The "random" ports you've found are a result of how TCP connections work. The client initiating the connection uses a well-known port for the destination port (e.g. port 80 for HTTP traffic) and then uses a random high-numbered port for the source port. When the server replies, this situation is reversed. In this example, the source port would be port 80 and the destination port would be the high-numbered port.

You didn't mention the type of firewall you use. Assuming it's a modern stateful inspection firewall, you don't need to worry about the high-numbered ports. If you want to allow Web traffic from the internal network out to the Internet, you simply need to allow port 80 traffic outbound. The firewall will recognize and handle the traffic for the related high-numbered port used by each connection.

More on network security :

  • Visit our TCP/IP resource center and learn how to maintain secure Internet connections to transfer data between two familiar networks.
  • Learn how stateful inspection firewalls and proxy firewalls differ.
  • This was first published in August 2006