I don't know much about how TCP/IP works, so please bear with me here.

I was wondering how, when your computer makes an HTTP request from a random port(on that device) to port 80 on a server, it gets the response from that HTTP request, that is, how the server sends the requested data back to the requesting device without an open port on the router?

As far as I know, for any external device(outside the LAN) to communicate with a device inside a LAN, there must be an open port on the router directing the public IP of the router to a certain port on a LAN device, so how would a webserver return requested data do a LAN device?

I think it has something to do with how TCP sockets, but I don't really understand how they work.

Also, I am sorry if this is a duplicate, I was not able to find any answer to my question on Google(that might just have been because of how I worded my question).


Routers route IP packets based on the IP address, and they have no clue about the transport protocol (TCP, UDP, etc.) or the transport addresses (ports). You seem to be concerned with the NAPT variant of NAT, which is something completely different, even though a router or firewall is the normally convenient place to run the NAPT. Routers will route packets perfectly well without NAPT.

You need to understand NAPT and how it works to understand the one-way nature of it, and what forwarding (not opening) a port means for it.

NAPT maintains tables (one for each protocol of TCP, UDP, and ICMP) for how to forward traffic. An inside-initiated packet will create a dynamic table entry with the both source and destination IPv4 and transport protocol addresses which allows return traffic from the outside IPv4 and transport address to the inside IPv4 and transport address in the table entry for the protocol used. What port forwarding does is to create a manual entry in an NAPT protocol table.

  • Would a port be vulnerable during the time between sending a request and waiting for a response? Sep 22 '20 at 16:48
  • It could be slightly vulnerable, but remember that the table is looking at both the source and destination IP and transport addresses, so an attacker would need to completely spoof all that, meaning it could not get a response. Also, TCP connections have other things, e.g. sequence numbers, that must match, otherwise the TCP segments are dropped. It is pretty complicated to even try.
    – Ron Maupin
    Sep 22 '20 at 16:52
  • Would the browser software also be responsible for the security of that open port? Sep 23 '20 at 14:53
  • 1
    You keep saying open port, but that is something else. Remember that TCP sets up connections that require both the same source and destination IP and TCP addresses, and TCP requires specific things to match, such as the sequence number. Trying to get everything correct is nearly impossible, and TCP will reject anything that does not correctly match it all. An outsider will not match the source IP address, and trying to guess the correct sequence number from over 4 billion is a crapshoot.
    – Ron Maupin
    Sep 23 '20 at 15:17
  • 1
    @SagarPatil, in any case, NAPT is not about security, it is about saving IPv4 addresses (which we have exhausted) until IPv6 is ubiquitous. IPv6 does not have NAT because there are more than enough addresses for every device to have its own global address, restoring the IP end-to-end paradigm.
    – Ron Maupin
    Sep 23 '20 at 15:21

Generally static nating is configured on router to ensure and public ip address is translated with private ip address of web server . If router is deployed as perimeter devices in setup then static nat configuration has to be done on router and access-list is configured to control inbound and outbound traffic . If access-list is configured then port 80 should allow in routers access-list to accept HTTP request from outside network towards LAN network .

If any firewall is deployed as perimeter device in network topology static Natting should be configured for inbound traffic, PAT ,NAT overload ,hide NAT should be configured for outbound traffic . specific port 80 should be allowed on firewall security policy as

Source interfàce : egress interface(ISP)

Souce address : ANY

Destination interfàce :ingress interfàce (LAN)

Destination address : webserver natted public ip

Port : TCP -80

Action : allowed

Note : To establish this connectivity to ensure services on port 80 is listening on destination web server , you can check status of this services by selftelneting on specific on webserver

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.