I use Windows 10 home on my personal computer. I opened up cmd and ran:

netstat -a

I saw a large list of ports that are on "LISTEN" mode and some others I couldn't recognize their state as I never learned much Information Security and I just want to filter ports I don't use because I might install Windows software that might listen on them without being aware to that.

Will you agree that minimal usage in Windows10 (SSH via WSL/Putty, web surfing and some PC games requiring web connection and sometimes TeamViewer) justify filtering of all ports besides 22, 80, 443?

In my VPS for example (the one I login to with Putty SSH tunnel, I filtered all ports besides 22, 25 (for Postfix), 80, 443 and 9000 for PHP-FPM) and I wonder if my Windows 10 (on which I don't use port 25 or 9000) should also be that "fortified" by means of port filtering.

  • I'm confused about the traffic directions that you are worried about. Do you want to filter outgoing connections? We can't tell you what ports to filter because we do not know what services you are running that might require open ports. – schroeder Jan 18 '18 at 19:05
  • I want to filter these ports bilaterally, so that both incoming and outgoing wont go beyond these ports (I mean to all ports besides 22/tcp, 80/tcp, 443/tcp, 5938/tcp+upd). – Arcticooling Jan 19 '18 at 2:32
  • Ok, so you saw all those ports in LISTEN mode, but what does your firewall say? Do you want to filter or do you want those services stopped? Are you asking for a port list? What are you asking? – schroeder Jan 20 '18 at 23:38
  • AFAIK the only ports I use in Windows are 22, 80, 443 to login to my Linux VPSE, surf the web, use TeamViewer and some PC games requiring web authentication. I don't know what Windows itself requires (especially, what it requires to properly protect my PC with Windows defender). So given I don't know, I ask if the best practice to filter all unused ports (that schroeder reminded in his answer) is relevant in Windows 10 home in the PC, with the usage I describe. Should I filter these?, if so, how? I's not like ufw enable -y && ufw allow 22/tcp 25/tcp 80/tcp 443/tcp 9000/tcp, I assume. – Arcticooling Jan 21 '18 at 0:19
  • Have you looked at the Windows Firewall? And the whitelist of allowed apps? – schroeder Jan 21 '18 at 0:40

The standard, industry best practice is to only allow the ports that you need to function. So, yes, use the built-in Windows firewall and only allow the ports you need.

Windows makes this very easy for you with the Defender Firewall and a whitelist of apps that can communicate. This is superior to a simple port list because an unapproved app cannot communicate via an unfiltered port.


There's a couple of different components to the answer:

  1. I think you have a misunderstanding of ingress vs egress and stateful firewalls. Most stateful firewalls (IPTables configured with ufw, the Windows firewall) will allow any traffic related to an already established connection through the firewall. They only filter on the initial connection setup.
  2. Most workstations have no need for any ports to be open in their inbound firewall policies. Inbound ports are only necessary when you expect other hosts to connect to a service you are hosting.
  3. Limiting outbound ports to something like the set you have listed is a reasonable thing to do, but might result in other software not working as intended. For example, bittorrent, voice/video chat, etc., often use other ports for communications.
  4. Don't forget port 53 on both TCP and UDP. DNS is rather important. Or useful, at least.

As schroeder points out, there's the alternative of using application-based firewalling. Then you can allow individual applications the choice to communicate or not. (Your web browser, putty, etc.) With this choice, you'll probably discover quite a few things that will need additional whitelisting as you go, such as updaters/installers, etc.

  • Also port 123 (network time synchronization) is worth allowing. – ximaera Jan 22 '18 at 13:49

There are probably a lot of ports in LISTEN state that are open on or any other address which starts with 127. . You can easily ignore those, they are needed for local services to function and are also guaranteed to be unreachable from the outside. More information: localhost, loopback.

Except for that, there should be about 5-6 listening ports at most. You can use stateful Windows firewall to filter inbound traffic towards those ports, within your usage scenario you won't run into any trouble with that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.