Ports and Firewalls — Understanding Network Security

What Are Ports?

A port is like a numbered door on your computer. While the IP address identifies the building, the port determines which service inside the building is being addressed.

Ports are numbers from 0 to 65535. Every network service listens on a specific port:

Port Categories

• Well-known ports (0–1023) — Standard services like HTTP, HTTPS, SSH
• Registered ports (1024–49151) — Registered applications
• Dynamic ports (49152–65535) — Temporary client connections

What Is a Firewall?

A firewall controls inbound and outbound network traffic based on defined rules. It decides which ports and connections are permitted or blocked.

Types of Firewalls

Packet-filter firewall Inspects each packet individually based on IP address, port and protocol. Simple but effective.

Stateful firewall Tracks the state of connections. It can distinguish between a packet that belongs to an existing connection and a brand-new connection attempt.

Application firewall (WAF) Analyses packet contents and can detect application-level attacks like SQL injection or cross-site scripting.

Why Open Ports Are a Risk

Every open port is a potential attack surface. If a service listening on a port has a known vulnerability, an attacker can exploit it. The risk grows with:

• Outdated software — services with documented CVEs
• Default credentials — databases or admin panels still on factory passwords
• Unnecessary exposure — services that should be internal-only, but listen on public interfaces
• Information leakage — banner grabbing reveals software versions to attackers

Particularly Risky Open Ports

• Port 22 (SSH) — frequent target for brute-force attacks
• Port 3389 (RDP) — Remote Desktop is a popular ransomware entry point
• Port 3306 (MySQL) — databases should never be publicly reachable
• Port 23 (Telnet) — transmits credentials in plaintext; should be disabled completely

Port Scanning: Check Your Own Security

A port scan checks which ports are open on a system and which services are running. It's the first step toward hardening a system:

1. Use our Port Scanner
2. Enter your IP address or domain
3. Review which ports are open
4. Close everything that isn't needed

A port scanner sends connection attempts to a range of ports and analyses responses:

• Open — a service is listening and accepted the connection
• Closed — the port is reachable but no service is running
• Filtered — a firewall blocked the probe (no response)

Best Practices for Network Security

• Open only the ports you need — close everything else
• Move SSH to a non-default port — changing port 22 to e.g. 2222 reduces automated scan noise by an order of magnitude
• Use Fail2ban — blocks IPs after repeated failed login attempts
• Scan regularly — check your ports at least monthly
• Patch promptly — apply security updates to listening services without delay
• Use a VPN for sensitive services — databases, admin panels and internal tools should sit behind a VPN, not on the public internet

Practical Example: Hardening SSH

The single most-attacked port on a fresh Linux server is 22. A pragmatic hardening checklist:

1. Disable password authentication — use SSH keys only:

   PasswordAuthentication no
   ChallengeResponseAuthentication no

2. Disable root login:

   PermitRootLogin no

3. Restrict by source IP in firewall rules where possible:

   iptables -A INPUT -p tcp --dport 22 -s 203.0.113.5 -j ACCEPT
   iptables -A INPUT -p tcp --dport 22 -j DROP

4. Install Fail2ban with the SSH jail enabled
5. Run a port scan afterwards to confirm only the expected ports are exposed

These five steps eliminate roughly 99 % of the noise on a public-facing SSH endpoint.

Conclusion

Understanding ports and firewalls is foundational to network security. Regular port scans and a restrictive firewall configuration protect against the most common attacks. The single most effective habit is to scan your own infrastructure on a schedule — most security breaches are old known issues on ports nobody remembered were open.

Tip: scan your IP right now with our free Port Scanner.