If a port is closed how come you can still use it?

Question

What does it actually mean for a port to be closed or stealthed? According to tests I've run all my ports (tested) are stealthed but clearly I can still use the internet. Also are the terms "blocked" and "closed" synonyms in this context?

Answer 1

You are probably using a stateful firewall. These are usually configured so that inbound traffic at those ports is forbidden if it doesn't belong to a connection made from the trusted network adapter (the private network). Therefore when scanning a port on the firewall it most likely will be blocked.

Answer 2

What does it actually mean for a port to be closed or stealthed?

Ports are usually talked about in terms of TCP and UDP. When speaking of closed ports, the system replies back with a message saying there is nothing there. For UDP and in theory any other protocol regardless of the concept of ports, a destination unreachable message would be generated if there were no service attached the port. TCP is different; because of it's stateful nature and control flags, it is able to indicate a closed port on its own by sending a packet back with the reset ("RST") bit set.

A stealthed port means one where a firewall rule dropped the packet without replying.

Also are the terms "blocked" and "closed" synonyms in this context?

Blocked ports generally refer to when situations where even if an application is listening on the port, the operating system or some upstream device (firewall) refuse to pass traffic and send messages indicating closure. From an outside perspective, this can be determined if the filtering happens upstream due to a different source address or number of hops taken by the packet. From an inside perspective, one notices that no incoming connections can be made.

According to tests I've run all my ports (tested) are stealthed but clearly I can still use the Internet.

A stateless firewall can reject new incoming TCP connections by preventing any inbound traffic that only has a SYN flag set. A stateful firewall can track whether any communication over that socket was originated from inside the network or from the outside for any protocol it is aware of which universally includes TCP and UDP.

Many Internet protocols are client / server based, and the end-user is on the client side of that, thus originating the connection. DNS queries, HTTP requests, etc. are all initiated from your side. Since your firewall device (or NAT router) is allowing outbound traffic and associated inbound traffic back, this works. Applications that act as equal peers or client / server applications where you're acting as the server would not work unless you specified rules to allow them because there would be no prior connection for the device to match and allow inbound traffic against.