0

I'm behind a router and I'm able to run game servers on my home computer after forwarding ports or using the DMZ feature on the router. However, I still don't understand the underlying technology as to how a browser can access the internet without you having to open up any ports.

If you're behind a firewall and all the ports are blocked, how is your browser able to access the internet (or any application for that matter)?

Improve this question
2
  • "I'm behind a router and I'm able to run game servers on my home computer after forwarding ports or using the DMZ feature on the router." First, home networking and consumer-grade devices are explicitly off-topic here. Next, the port forwarding you are doing is about NAPT, not the firewall. Port forwarding is putting an entry in the NAT table. Firewalls use rules, which are separate from the tables used by NAPT. It is a mistake to confuse NAT and firewalls, although a firewall is often a good place to NAT.
    – Ron Maupin ♦
    Aug 23, 2019 at 23:20
  • @RonMaupin My question isn't about home networking nor consumer-grade devices.
    – user3163495
    Aug 23, 2019 at 23:22

2 Answers 2

Reset to default
5

A firewall does not "block all ports" - otherwise you could just pull a cable instead of having some firewall. Instead simple firewalls block all incoming connections (what you read as all ports blocked) but allow all outgoing connections - and in the case of web surfing the connections are initiated from inside and are thus outgoing.

Most firewalls today are stateful, which means that they keep internal states for established connections or connections which are in the process of getting established. Any incoming data are matched against this state table and if there is a matching state the data are passed from outside to inside. Any other outside data which don't match any state are discarded.

This way a firewall allows the internal browser to establish a connection to an external site and allows the response from the external site to get passed back to the browser through the firewall. And at the same time it discards any other data from outside, i.e. "all ports closed".

Improve this answer
3
  • I see--are the "states" defined by some GUID that gets included with every packet?
    – user3163495
    Aug 23, 2019 at 21:22
  • 1
    @user3163495 A connection's state is based on its history. An internal host sends a TCP SYN, so the firewall accepts an ACK from the external host in reverse and so on.
    – Zac67 ♦
    Aug 23, 2019 at 21:39
  • 1
    @user3163495: I recommend Wikipedia: Stateful firewall for a more detailed explanation on how this works.
    – Steffen Ullrich
    Aug 23, 2019 at 22:34
0

If PCs are behind firewall and wants to access internet from PCs then connection type is outbound in this scenario ports required should be opened at firewall end which is depolyed at perimeter level whereas as ISP is connected to egress interface of firewall .

Example of policy

Source interfàce : ingress interface

Destination interfàce: Egress interfàce

Source address :LAN subnet

Destination address : ANY

Service ports : required ports as per business or user requirements

Action : Allow .

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.