Ports! Which are bad and which are good?

acidrain

acidrain

Executive Member
Joined
Jan 7, 2007
Messages
7,004
Reaction score
1,797
Location
At a computer
Been doing up some research on network security since our local LAN has been struggling a bit....

....so for those wanting to know which ports ( and there are stax of them ) are bad and should be closed and which are good here is a site that lists all of them with a description of each port.

Vulnerable Ports

Enjoy :D
 
Starting with all open and closing the dangerous ones sounds like a DOS-era approach.:eek:
 
What firewall you using? - Usually most learn as you go. Even a trojan on your pc would need to ask the firewall permission to connect to the net...
 
MeNeZ said:
What firewall you using? - Usually most learn as you go. Even a trojan on your pc would need to ask the firewall permission to connect to the net...
Click to expand...

Using Comodo Pro, sure a trojan would need to ask for permission but activities such as a simple echo request ( i.e. ICMP, ) does not and as you know, having a port opened for echo requests can leave you vulnerable to DoS attacks

Edit: Plus instead of just doing what your firewall tells you with regards to ports, with this lists you can at least find out what the port does and what uses it ( if an occurance arises where an application tries to access the internet through a port and you have absolutely no idea whether the app is good or bad )
 
Last edited:
having a port opened for echo requests can leave you vulnerable to DoS attacks
Click to expand...
If Comodo receives more than 50 ICMPs in a second it starts blocking them automatically. You can increase sensitivity under "Advanced attack detection and prevention".

with this lists you can at least find out what the port does and what uses it
Click to expand...
True. Some nasty stuff always uses the same port.
 
gregmcc said:
There's an easier way - close all ports and open only those which are required.
Click to expand...

Smoothwall v3 have 3 security settings - closed (every outgoing port is closed, and have to be opened by the administrator), half open (certain, most-used ports are open, such as POP3, SMTP, HTTP and HTTPS) and open (every outgoing port is open).

MeNeZ said:
What firewall you using? - Usually most learn as you go. Even a trojan on your pc would need to ask the firewall permission to connect to the net...
Click to expand...

In a corporate environment, it is not feasible to have a firewall on every single PC - the sysadmin will waste a lot of time running around. Also, most of the perimeter firewalls in use does not block outgoing, but block incoming requests. In such a scenario, starting off with all outgoing ports blocked, and then opening ports as you need them will be a very good move.

Trojans will find ways and means of bypassing a local firewall on your PC.
 
HavocXphere said:
If Comodo receives more than 50 ICMPs in a second it starts blocking them automatically. You can increase sensitivity under "Advanced attack detection and prevention".


True. Some nasty stuff always uses the same port.
Click to expand...

The Guardian mod does the same - on receipt of a bad packet, or somebody does something naughty to one of your ports, then said offending IP gets blocked for a period (longer than 24hrs IIRC).

The problem arises when the hacker spoofs his IP, or uses somebody else's PC to attack yours - the hacker will always have a PC with an unblocked IP to attack your PC while your bandwidth gets depleted with each attack, courtesy of telkom.

Or masquerade as a trusted application (in this case, some rogue DLL's inside Internet Exploder) which will sends data out via port 80 - and the local firewall none the wiser.
 
HavocXphere said:
If Comodo receives more than 50 ICMPs in a second it starts blocking them automatically. You can increase sensitivity under "Advanced attack detection and prevention".
Click to expand...

Think mine is set to 20... but just saying that for some who dont use a firewall that has this neat trick ( if one does exist )

Just having a problem with Comodo, seems to be blocking all the guys trying to access my server yet ive set a rule to allow all incoming ftp connections on port 21 with ip range 192.168.1.1 - 192.168.1.249.

Any ideas you have? cos i dont like turning the firewall off just so ppl can access my server. ( Currently running Comodo in "Training in safe mode" )
 
most of the perimeter firewalls in use does not block outgoing
Click to expand...

Most perimeter firewalls should block incoming and outgoing. You should always only grant the least priviledge access. If you have a corporate proxy then only allow it out and not allow everything. If all outgoing ports where open it would be chaos - users could browse whatever they liked, mass mail viruses would be rampant, auditing and access control would be out the window.

In a corporate environment, it is not feasible to have a firewall on every single PC
Click to expand...

Depends on how secure you want to be. A standalone firewall on each desktop would be a nightmare! you need a firewall product when policies can be controlled via a management station. Its a good idea having firewalls on laptops as when users take them home who know's where they try and connect to :)
 
Last edited:
gregmcc said:
Most perimeter firewalls should block incoming and outgoing. You should always only grant the least priviledge access. If you have a corporate proxy then only allow it out and not allow everything. If all outgoing ports where open it would be chaos - users could browse whatever they liked, mass mail viruses would be rampant, auditing and access control would be out the window.

Depends on how secure you want to be. A standalone firewall on each desktop would be a nightmare! you need a firewall product when policies can be controlled via a management station. Its a good idea having firewalls on laptops as when users take them home who know's where they try and connect to :)
Click to expand...

:D

Luckily you get the Dansguardian mod which filters out pr0n and hate speech sites. You can also add or define your own list of "verboten" sites.

Agreed - laptops do need a firewall. :o
 
I use M0n0wall. I close all ports and open up only the necessary ones. I also force the users to use my proxy for all internet browsing which has filters aswell.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X