IT personnel who regularly work with routers and firewalls can readily tell you which protocols and ports are associated with each other. For example, they readily know what protocols are associated with the following well-known ports: 20, 21, 22, 23, 25, 80, and 443. They regularly use these ports to allow or block traffic.
If you’re planning to take the Security+ exam, you should have a basic understanding of relevant protocols and ports to implement basic network security.
For example, can you answer this question?
Q. Bart wants to block access to all external web sites. Which port should he block at the firewall?
A. TCP 22
B. TCP 53
C. UDP 69
D. TCP 80
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Will you see port questions on the Security+ exam? You never know. However, I saw two.
Source and Destination Ports
Imagine that you decide to visit the web site http://GetCertifiedGetAhead.com using your web browser so you type the URL into the browser, and the web page appears. Here are the details of what is happening. The figure provides an overview of how this will look and the following text explains the process.
Using source and destination ports
Your computer creates a packet with source and destination IP addresses and source and destination ports. It queries a DNS server for the IP address of GetCertifiedGetAhead.com and learns that the IP address is 72.52.206.134. Additionally, your computer will use its IP address as the source IP address. For this example, imagine your computer’s IP address is 70.150.56.80.
Because the web server is serving web pages using HTTP and the well-known port is used, the destination port is 80. Your computer will identify an unused port in the dynamic and private ports range (a port number between 49,152 and 65,535) and map that port to the web browser. For this example, imagine it assigns 49,152 to the web browser. It uses this as the source port.
At this point, the packet has both destination and source data as follows:
- Destination IP address: 72.52.206.134 (the web server)
- Destination port: 80
- Source IP address: 70.150.56.80 (your computer)
- Source port: 49,152
TCP/IP uses the IP address (72.52.206.134) to get the packet to the GetCertifiedGetAhead web server. When it reaches the web server, the server looks at the destination port (80) and determines that the packet needs to go to the web server program servicing HTTP. The web server creates the page and puts the data into one or more return packets. At this point, the source and destinations are swapped because the packet is coming from the server back to you:
- Destination IP address: 70.150.56.80 (your computer)
- Destination port: 49,152
- Source IP address: 72.52.206.134 (the web server)
- Source port: 80
Again, TCP/IP uses the IP address to get the packets to the destination, which is your computer at this point. Once the packets reach your system, it sees that port 49,152 is the destination port. Because your system mapped this port to your web browser, it sends the packets to the web browser, which displays the web page.
Protocol Using Well-known Ports
Routers, and the routing component of firewalls, filter packets based on IP addresses, ports, and some protocols such as ICMP or IPsec. Because many protocols use well-known ports, you can control protocol traffic by allowing or blocking traffic based on the port.
In the previous example, the client firewall must allow outgoing traffic on port 80. Firewalls automatically determine the client ports used for return traffic, and if they allow the outgoing traffic, they allow the return traffic. In other words, because the firewall allows the packet to the web server on port 80, it also allows the web page returning on the dynamic port of 49,152.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Note that the client firewall doesn’t need to allow incoming traffic on port 80 for this to work. The web client isn’t hosting a web server with HTTP, so the client firewall would block incoming traffic on port 80. However, the firewall that is filtering traffic to the web server needs to allow incoming traffic on port 80.
You can apply this same principle for any protocol and port. For example, if you want to allow SMTP traffic, you create a rule on the firewall to allow traffic on port 25. Similarly, if you want to block Telnet traffic, you ensure that the firewall blocks port 23.
IT professionals modifying ACLs on routers and firewalls commonly refer to this as opening a port to allow traffic or closing a port to block traffic.
Q. Bart wants to block access to all external web sites. Which port should he block at the firewall?
A. TCP 22
B. TCP 53
C. UDP 69
D. TCP 80
Answer is D. He should block port 80 because web sites use Hypertext Transfer Protocol (HTTP) over TCP port 80.
Secure Shell (SSH) uses TCP port 22.
Domain Name System (DNS) uses TCP port 53 for zone transfers.
Trivial File Transfer Protocol (TFTP) uses UDP port 69.
