Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What does it actually mean for a port to be closed or stealthed? According to tests I've run all my ports (tested) are stealthed but clearly I can still use the internet. Also are the terms "blocked" and "closed" synonyms in this context?

share|improve this question
    
By any chance is it the public IP of a NAT router you tested against? –  ewanm89 Nov 24 '12 at 23:09

2 Answers 2

up vote 3 down vote accepted

You are probably using a stateful firewall. These are usually configured so that inbound traffic at those ports is forbidden if it doesn't belong to a connection made from the trusted network adapter (the private network). Therefore when scanning a port on the firewall it most likely will be blocked.

share|improve this answer
2  
Or a NAT router which is even more likely. And has the same effect. –  ewanm89 Nov 24 '12 at 23:13
    
So basically NAT routers and stateful firewall don't allow incoming connections unless an outgoing connection had been made to that IP address from the same port? –  Celeritas Nov 25 '12 at 0:51
    
@Celeritas That's the gist of it. Probably over-simplified a bit, but accurate enough for the purposes of addressing this question. –  Iszi Nov 25 '12 at 4:27
    
@Celeritas Yes. That's exactly the default behavior. –  Jeff Ferland Nov 25 '12 at 4:27
    
@Celeritas - it's probably worth explaining that when you connect to a server on port 80, the communication back to your computer may well not be on port 80, but rather a random high number port is typically chosen and used for the connection. In the case of NAT, the router shares an IP address with multiple computers by mapping high number external ports to connections to particular computers inside the network, but the connections are always started from inside the network and only the host that is connected to can get back in through the NAT. –  AJ Henderson Nov 26 '12 at 18:02

What does it actually mean for a port to be closed or stealthed?

Ports are usually talked about in terms of TCP and UDP. When speaking of closed ports, the system replies back with a message saying there is nothing there. For UDP and in theory any other protocol regardless of the concept of ports, a destination unreachable message would be generated if there were no service attached the port. TCP is different; because of it's stateful nature and control flags, it is able to indicate a closed port on its own by sending a packet back with the reset ("RST") bit set.

A stealthed port means one where a firewall rule dropped the packet without replying.

Also are the terms "blocked" and "closed" synonyms in this context?

Blocked ports generally refer to when situations where even if an application is listening on the port, the operating system or some upstream device (firewall) refuse to pass traffic and send messages indicating closure. From an outside perspective, this can be determined if the filtering happens upstream due to a different source address or number of hops taken by the packet. From an inside perspective, one notices that no incoming connections can be made.

According to tests I've run all my ports (tested) are stealthed but clearly I can still use the Internet.

A stateless firewall can reject new incoming TCP connections by preventing any inbound traffic that only has a SYN flag set. A stateful firewall can track whether any communication over that socket was originated from inside the network or from the outside for any protocol it is aware of which universally includes TCP and UDP.

Many Internet protocols are client / server based, and the end-user is on the client side of that, thus originating the connection. DNS queries, HTTP requests, etc. are all initiated from your side. Since your firewall device (or NAT router) is allowing outbound traffic and associated inbound traffic back, this works. Applications that act as equal peers or client / server applications where you're acting as the server would not work unless you specified rules to allow them because there would be no prior connection for the device to match and allow inbound traffic against.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.