Open Ports

When you talk about open ports, you are talking more about firewalls than routers. The functions of routing and firewalling are often combined in a single machine. A multihomed computer running firewall software could route traffic through any of its interfaces.

Open ports would be open all the time to allow traffic when it needs to go out. By allowing the outbound traffic, you also allow the return traffic from that destination to the source port.
For example: Your computer uses port 16041 (or any ramdom high level port) to connect to a web server listening on port 80 for http traffic. That web server returns the traffic to port 16041 on your computer. However, that web server would not be able to create a path to your computer because you have closed incoming ports.

Hi,

the concept of open ports apply on both firewalls and routers.

i assume you are asking a "router" question here.

on a router, if you allow e.g. port 25 and port 80 outbound. This means that your network is able to SEND port 25 and port80 traffic OUT all the time. Nothing else can exit your network.

however, if you have all inbound ports blocked on a router, you will not be able to receive any incoming traffic AT ALL. this is very important.

this actually means that although you can connect to a web server on port 80, you will not be able to receive incoming web traffic UNLESS you configure your router to accept ESTABLISHED TCP connections.

if you are using a cisco router, you may want to check this out.

http://www.cisco.com/univercd/cc/td/doc/product/at
m/c8540/12_0/13_19/cmd_ref/a.htm#1021511

by configuring a proper access list, you would be able to use your router as an effective network-layer security device too :)

as a security professional, iwould definitely advise on a layered-approach always :)

have fun!

Hi Greybeard...

No flames intended here as we are all professionals and learning from one another all the time :)

Correct me if I'm wrong but...

"Open ports would be open all the time to allow traffic when it needs to go out. By allowing the outbound traffic, you also allow the return traffic from that destination to the source port."

IMHO, your answer is not complete. This is not true always, UNLESS your network device keeps track of the state i.e. if you are referring to a firewall, it must be a stateful inspection firewall. Otherwise, it will not allow the return traffic from that destination to the source port. either that .. or you may have meant

"By allowing the outbound traffic, you also allow the return traffic from that destination to the source port."

then your answer wouldn't seem incomplete and contradictory when you ended off with..

"However, that web server would not be able to create a path to your computer because you have closed incomingports."

This question was closed by the author