Port Cad Block

[Zee Palmer]

A few days back I wanted to play AOE2 over internet. For that I used Voobly application for finding the users and launching the game. But problem was that since my local ISP had blocked port 16000, I was unable to play. I asked the local ISP to forward the port 16000 and they didn't know what did that mean.

Without VPN your traffic is going to the router and it forwards it to the ISP. Let's say that the traffic is "naked", so the ISP can inspect the traffic and when they find your packets aimed to port 16000 they block them.

With a VPN the traffic going out of your computer is encrypted and then put inside "innocent" packets that act as a wrapper using a port like 8080 or 8081. Your ISP can still inspect your traffic but they will find port 8080 and as it is not the usual suspect they let them pass.

VPN isn't necessarily overcoming port blocking as the vpn still needs a port to use which most vpn's that use L2TP tunnenling use ports 500 and 4500. It depends which type of tunneling the application uses, as well as ports for vpn applications can be modified.

Essentially, a VPN is tunnel network to another system to allow you secure connections for various things. From hiding your true IP from websites, to overcoming port blocking for applications, because the tunnel uses a port thats not blocked and the application essentially uses the system's network you connected to for communication through the tunnel.

Since you called your ISP about it, most tech support representatives, the ones that answer your call first, generally don't need/require the need to know much about networking. So, if you do ever call them again for opening a port for you etc, just ask for their network egineer or IT Department lol. They usually will know what you are talking about and can give you a more informative answer on whether they can do that for you or if they can't.

Any time the FortiGate does a NAT operation (source IP, or destination IP) the traffic source port is randomized (by default), which means you can run into this. You can enable fixed port on the policy to prevent the randomization but obviously this is not recommended since 99% of software won't care or notice. The Fixed port setting can be the cause of this message as well so if you have it enabled, turn it off.

I'd also suggest upgrading to a newer 5.0 patch. I do recall there was a bug in the FortiGate firmware about nat port exhaustion not that long ago, but i don't remember exactly which versions were effected.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

After this, if you are expecting incoming connections on this port and feel that the firewall may be blocking them, you could use start windows firewall logging and check the logs for dropped connections

If you are running an application/service that is listening on 3306, the firewall config should show it to be Enabled. If this is not seen, you have probably missed adding an exception with the firewall to allow this app/service.

Finally, port 3306 is typically used for MySQL. So, I presume you are running MySQL server on this windows machine. You should therefore see a listener for 3306 accepting incoming connections. If you do not see that, you need to work with your application (MySQL) to get that started first.

NETSTAT will tell you if the port is listening but it will not tell you if the port is open to the outside world. What I mean by this is that NETSTAT may show that the 0.0.0.0 is LISTENING on port 3306 but a firewall may still be blocking that port which is preventing outside connections; so it isn't sufficient to rely on NETSTAT alone.

I've set up an FTP site on IIS (windows 7 home) and set up a rule in the Windows Firewall allowing access. The ftp site is accessible via my local browser to my static IP (ftp.example.com, where DNS is godaddy, so its resolving to my static IP and the ftp directory is being served).I've also set up a rule in my uVerse router firewall allowing FTP Server access to this machine.However, my customer cannot reach my FTP site, and when I test using mxtoolbox.com ..

Furthermore, I can add other open ports, such as IMAP and POP3, and they show as open once I edit the router firewall. No matter how many times I delete and add FTP Server, port 21 never shows as open on mxtoolbox.com, and of course the customer cannot reach the FTP site. He can successfully reach my locally-hosted webpage.

From the remote site, you can use traceroute to work out where in the path the port is blocked. Note that this has to be a *nix traceroute, eg linux, as Windows does not support traceroute over arbitrary ports.

Note that it is the IP after the last successful hop that tells you where the block is - ie, the hop that does not respond. So look for the next hop in the port 80 traceroute after the last successful one in the port 21 traceroute.

If you'll notice, your source in your logs is coming from a different port. I'm guessing this is why you aren't matching. I'd try modifying the TCP 445 service to only include destination port (leave source port blank) and see if that works.

@jsalmans is currect, the rule that you have listed wouldn't match because you wouldn't have a source port of 445 as specified. One would usually just look for the destination port of 445 if this is something that you are looking to do. That would look like this to actually get it to build out currectly from the CLI.

This would get rid of the malformed "Port Blocks" rule, configure a proper "Port Block" policy (assumes that the service configured is tcp-445), moves the new "Port Block" rule above your "L3-MPLS to Untrust" rule.

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the non-standard port I'm using for SSH connections.

But seeing as how my server already only has services running on those ports anyway, would it just be pointless? I don't really have a need right now to region-block IPs or anything complex like that.

In simple words that someone with a not-so-complete understanding of IP networking can understand, would it still be useful for me to configure a firewall in this way? How, functionally, is it different from just continuing to not run services on the ports I would block?

It protects against having to manually configure services to only listen on localhost, as you have to manually allow them network connectivity, and it increases the effort an attacker must exert to recon your box. This means it's an effective tool both against attackers and poor configuration. Yes, you should run a firewall.

You appear to be familiar with the two states - ports default to "closed", switching to "open" if there is a service listening. It's very fast to enumerate both open and closed ports - the OS will actually send a response saying either "there is a service here" (port is open), or one saying "there is no service here" (port is closed).

If you use a firewall, it provides the option to filter ports. For filtered ports, the OS does not respond at all. This means an attacker must invest more time to determine port states, as they have no way to know if the computer didn't send any response, or if the response was lost in transit.

In the ideal world, an open port without any services running behind it is the same as a port that is not opened. In the real world, humans make mistakes. The less control you have on a system, the more likely any attack on your system would be amplified by a mistake.

A firewall serves to mitigate your mistake by adding an additional layer of control to your computer system. It does so by accepting, rejecting or dropping connections based on your configuration. As a side effect, it helps to reduce your attackers' ability to fingerprint your operating system (OS) to launch more targeted attacks.

If you are not familiar with your OS, there is a likelihood that you would accidentally re-enable disabled services or start new services that are installed via a system upgrade. Unless you consistently do a check using program such as netstat, these services would be quietly listening for incoming connections without your knowledge. Some of which may, over the course of time, become vulnerable to attacks and provide gap for an attacker to breach your system.

By running a firewall and blocking ports without active services, you are essentially hardening your system by providing redundancy in the event that a security control fails or a vulnerability is exploited during the system's life cycle. This approach is known as defense in depth.

We have a customer that makes use of Sophos Central Endpoint with InterceptX and we need to block end client user machines from being able to connect to anything on port 25, effectively blocking direct SMTP access. Previously the customer made use of McAfee VSE, and this had an option for blocking 'mass mailing' which acted as port 25 blocker, so we are hoping Sophos Central has a similar option/function?

c80f0f1006