1

I'm from a digital forensics background and it has been a while since I studied networking and so am a little rusty on a few aspects. I am looking to implement a remote forensics solution within an organisation and the vendor in question has specified that there will be two servers that will require connectivity to any endpoint/server on the network.

The first server authenticates and does this by sending various cryptographic keys via a specified port. This part is fine, I understand how this should be configured.

The second server pulls back the data, but it does so using "TCP Random High Ports", which I am assuming means any port >1024, whichever is available at the time, will be used to transfer the forensic acquisition to the server from the endpoint.

I'm not quite sure how this would work from a firewall perspective. The organisation was happy enough to open one port for this specific reason, but would this mean that ALL ports ?1024 need to be opened to allow for any random connection to take place? I'm surely missing something here, unless I am fundamentally misunderstanding things and high ports being open is common practice? I remember reading about stateless firewalls, and how they can "remember" legitimate traffic, would this be utilised here?

0

2 Answers 2

2

Typically, connections from clients to a server are made from a random high port on the client to the server's port (which is normally a low port, like port 443 for SSL/TLS/HTTPS websites).

So the firewalls allow traffic to a defined low port (e.g. 443) in, and being "stateful", automatically allow any return traffic to any port (including high ports) back to the client. The firewall keeps track of "sessions" so it can keep track of what's valid return traffic.

This session tracking is how traffic can be allowed dynamically through arbitrary ports, without needing to configure all possible client ports. This also keeps things more secure than having constantly open ports.

However, some applications require certain static ports to work in both directions. And in these cases, you need to open the static port. But this is a really old design pattern and is not usual.

2

Maybe they use a protocol like FTP where data (in FTP active mode) are transferred by the client listening on "random" ports for data connections and which port should be used is announced through the control connection. There are often ways to deploy this in a more firewall friendly way (FTP passive mode) or have an "application helper" on the firewall to dynamically open ports based on analyzing the control connection.

FTP is not the only protocol doing this. Most of the audio-/videoconferencing applications (protocols like SIP, H.323, WebRTC) do this too. In order to properly deal with the situation you need to know what kind of application this is, if it can be used in a more firewall-friendly way or if your specific firewall products has helpers for this application protocol which can open and close the necessary ports on demand.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .