I'm behind a router and I'm able to run game servers on my home computer after forwarding ports or using the DMZ feature on the router. However, I still don't understand the underlying technology as to how a browser can access the internet without you having to open up any ports.

If you're behind a firewall and all the ports are blocked, how is your browser able to access the internet (or any application for that matter)?

  • "I'm behind a router and I'm able to run game servers on my home computer after forwarding ports or using the DMZ feature on the router." First, home networking and consumer-grade devices are explicitly off-topic here. Next, the port forwarding you are doing is about NAPT, not the firewall. Port forwarding is putting an entry in the NAT table. Firewalls use rules, which are separate from the tables used by NAPT. It is a mistake to confuse NAT and firewalls, although a firewall is often a good place to NAT. – Ron Maupin Aug 23 '19 at 23:20
  • @RonMaupin My question isn't about home networking nor consumer-grade devices. – user3163495 Aug 23 '19 at 23:22
  • I didn't close it did I? You are using home networking as an example, and you really should not do that. For example, home routers have very little relation to how enterprise-grade (what is on-topic here) routers work. Many companies do not need to forward ports the way you describe because they have a block of public addresses, and they can expose the address, rather than use NAT. That doesn't mean the hosts/servers are not protected by a firewall. – Ron Maupin Aug 23 '19 at 23:25

A firewall does not "block all ports" - otherwise you could just pull a cable instead of having some firewall. Instead simple firewalls block all incoming connections (what you read as all ports blocked) but allow all outgoing connections - and in the case of web surfing the connections are initiated from inside and are thus outgoing.

Most firewalls today are stateful, which means that they keep internal states for established connections or connections which are in the process of getting established. Any incoming data are matched against this state table and if there is a matching state the data are passed from outside to inside. Any other outside data which don't match any state are discarded.

This way a firewall allows the internal browser to establish a connection to an external site and allows the response from the external site to get passed back to the browser through the firewall. And at the same time it discards any other data from outside, i.e. "all ports closed".

| improve this answer | |
  • I see--are the "states" defined by some GUID that gets included with every packet? – user3163495 Aug 23 '19 at 21:22
  • 1
    @user3163495 A connection's state is based on its history. An internal host sends a TCP SYN, so the firewall accepts an ACK from the external host in reverse and so on. – Zac67 Aug 23 '19 at 21:39
  • 1
    @user3163495: I recommend Wikipedia: Stateful firewall for a more detailed explanation on how this works. – Steffen Ullrich Aug 23 '19 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.