Some firewalls (like the first figure in 13.1.4 in http://doc.m0n0.ch/handbook/examples.html) allow user to specify source port in a firewall rules. But in a TCP connection, the source port is randomly selected from 1024 - MAX. So my question is, why we need to have a source port field in a firewall rule? And we can see that some other firewalls do not provide a source port field in their rule format (e.g. http://www.fwbuilder.org/4.0/docs/users_guide5/global-policy.shtml)

Thank you!


The source port is usually randomly selected, however applications do have the option to specify a source port. It's within the realm of possibility that someone would want to filter on a specific source port, although it is extremely rare.

In the past I've seen source port rules used in order to permit audio and video streaming when the firewall's H.323 detection was not automatically opening the ports, and that feature was tremendously useful in setting up a workaround.

|improve this answer|||||

One example where source port with TCP is necessary is active ftp. In this case the client (inside the firewall) listens on a kind of random port on the client for the data connection and notifies the server about this addr+port using the PORT command. The server then connects from port 20 - and this is the only restriction you can set if you need to allow active ftp.

|improve this answer|||||

You mention that TCP requests are (often) from randomized ports, but what about RESPONSES? An HTTP request might come from a random source port, but the reply will come from a known source port (80/443/ etc.). Sometimes you want control over the responses as well as incoming requests.

|improve this answer|||||
  • Yes. This is a good point. But I am thinking that you can always achieve your goal by only focusing on requests. – ZillGate Apr 14 '14 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.