Firewall port range 1

[robdon]

Hi,

I have an application running on WinXP, and it uses a certain port (6000) to comunicate on.

So in my firewall I allow access to this port.

However, the application uses another 'random' port to communicate back to the client (I think) and that port seems to be between 1000 - 2000.

I seem to have to allow access to ports 1000-2000 to get the client to connect.

I just wanted to check, how 'bad' is it for me to allow such a hugh port range available.

Thanks,

Rob Donovan.

 

[Xemus]

If you're curious about which vulnerabilities/trojans/worms operate in this range, check out the ports database.

http://www.portsdb.org/

or Dshield

http://www.dshield.org

I would recommend figuring out which ports your app needs and only allowing those specific ports (you've done this but maybe the program has been updated and now uses a different port?), or searching for a way to make it use a single port. A third solution would be to allow the ports in your firewall, then use a software firewall to block those ports, but allow the program to connect (set the firewall to block all by default, but specifically allow the program).

If this doesn't work, post the name of the program and someone here will probably have a more precise solution.

http://www.closedsocket.com

 

[robdon]

Hi,

Thanks for the tips,

Looks like the software firewall example would fit me best.

Rob D.

 

[bluedragon2]

Can you block 1000-2000 to incoming traffic, but open them to outgoing?





Blue

If I wasn't Blue, I would just be a Dragon...

 

[pansophic]

It sounds as if your application opens an ephemeral port for the return communications. Ephemeral ports are 1024-65535, but Windows won't choose ports above 5000 generally.

It is better if you can specify the port number on the client to use. If it is dynamic on both ends, then put in a rule from ephemeral ports on the server to ephemeral ports on the clients. If you can limit the client IP range, all the better.

It does increase the vulnerability of the server, and is probably not the best architecture for your application, but it isn't the end of the world. Is there a reason why you are opening 2 sockets for the connection, rather than sticking to a single socket?

Usually, the only reason to open a second socket is to handle some form of streaming data (UDP) with a control link (TCP).


pansophic

 

[robdon]

Hi,

I guess so, but its still a bit 'unsecure'

If I did managed to get infected with a trojen, then it could 'call base' and send back info from my pc through those ports...

Rob D.

 

[Marcs41]

Every open port is a security risk, so that is not the point.
What you can do is tell the firewall WHO (what IP) is allowed to use that port (if the firewall permits).

Also, some apps do use random port, a UPnp capable Firewall is needed in most cases.
What application is it anyway, that can bring some light to the matter.


Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}