0

Some firewalls (like the first figure in 13.1.4 in http://doc.m0n0.ch/handbook/examples.html) allow user to specify source port in a firewall rules. But in a TCP connection, the source port is randomly selected from 1024 - MAX. So my question is, why we need to have a source port field in a firewall rule? And we can see that some other firewalls do not provide a source port field in their rule format (e.g. http://www.fwbuilder.org/4.0/docs/users_guide5/global-policy.shtml)

Thank you!

3 Answers 3

1

The source port is usually randomly selected, however applications do have the option to specify a source port. It's within the realm of possibility that someone would want to filter on a specific source port, although it is extremely rare.

In the past I've seen source port rules used in order to permit audio and video streaming when the firewall's H.323 detection was not automatically opening the ports, and that feature was tremendously useful in setting up a workaround.

3

One example where source port with TCP is necessary is active ftp. In this case the client (inside the firewall) listens on a kind of random port on the client for the data connection and notifies the server about this addr+port using the PORT command. The server then connects from port 20 - and this is the only restriction you can set if you need to allow active ftp.

1
1

You mention that TCP requests are (often) from randomized ports, but what about RESPONSES? An HTTP request might come from a random source port, but the reply will come from a known source port (80/443/ etc.). Sometimes you want control over the responses as well as incoming requests.

2
  • Yes. This is a good point. But I am thinking that you can always achieve your goal by only focusing on requests.
    – ZillGate
    Apr 14, 2014 at 23:55
  • If you allow in one way you also allow in the other way so you get response. With firewall that keep state can you really do kind of one way HTTP ?
    – Et7f3XIV
    Aug 29, 2023 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .