I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are being used by ISPs to secure their customers and what are the limitations of this security?

3 Answers 3


ISP will routinely do the following for their customers:

  • Block incoming connections on some well-known ports (e.g. port 139, the classic port for Windows file sharing).
  • Block spam, virus and other malware sent over email.
  • "Block" some sites by removing the DNS mappings (the customer can still access them, but the ISP DNS server will not resolve the names).
  • Block outgoing connections to random external sites over port 25 (not all ISP do that, but many do).

Remember that, ultimately, the ISP do not protect customers; an ISP protects itself. The customer is always viewed with a bit of suspicion, and ISP engage resources on the protection of a customer mostly because they want to prevent the customer from becoming an active enemy. For instance, the blocking of outgoing connections to port 25 is a method to prevent a customer's machine from sending spam, in case that machine became part of a botnet: the ISP does not want to appear to be a haven for spammers. On a similar basis, some ISP will automatically detect or even block P2P protocols.

A good ISP will also apply a number of controls on its own infrastructure (firewalls, intrusion detection, redundancy...) in order to maintain its service, which can be viewed, indirectly, as a "protection" for its customers.

  • You did not really answer the second part of the question on limitations. What type of protection will an ISP not provide? And for your 2nd point "Block spam, virus and other malware sent over email", which email service are you referring to?
    – Jay
    Apr 13, 2014 at 13:28
  • Can ISP block you from accessing certain IP addresses? If yes, how can they do so?
    – Viet
    Apr 4, 2018 at 9:17

You did not really answer the second part of the question on limitations

This is a question about restriction. As Thomas rightfully pointed out, an ISP merely tries to protect itself. The more restrictions it imposes on users, the safer they'll be, but also the less they can do.

For example:

An ISP could treat it's customers like corporate users. All users are NAT'ed on private rfc1918 IP addresses, It employs a proxy server that only allows particular -good- websites, and email can only be sent using their mail gateway. Services such as BitTorrent, Tor, ... are all blocked, since these may introduce malware to its users. (Infected users would start to infect other users/networks, and the ISP will be contacted and need to investigate what happened.)

The problem with this is that, while it gives a secure environment, it takes away a lot of functionality and freedom, and people would simply complain:

  • Someone wants to have a public IP address to host a particular service on his home computer.
  • Someone wants to download content over the BitTorrent protocol
  • Someone wants to use another email service.
  • ...

Aside from obvious security protections (blocking SMTP, NetBIOS, ... ), it's usually a compromise. Providing enough protection for itself (and subsequently its customers), without restricting too many services.


Very limited. ISP providers can do a lot for residential customers; for example block connections into your home computer from outside of the USA IP Addresses. If you examine the PC logs you will find a large number of "ssh attempts" into your home computer from locations like Rumania, Russia, China, etc. Why the ISP provider "allows" this traffic into the residences?


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .