Port 80 and 443: closed, open or Stealth?

[Sr. Normal]

Hello friends

On page: https://www.grc.com/x/ne.dll?bh0bkyd2 perform safety testing your firewall. It is recommended that all ports in stealth, but I have 80 and 443 closed, which seems to be unsafe.

What do you think ?. Is it safe to be closed or is it better to be stealth?

How can I put them in the windows firewall in stealth mode ?, or, it will another firewall necessary?

Thank you in advance for your help

 

[hjlbx]

Hello friends

On page: https://www.grc.com/x/ne.dll?bh0bkyd2 perform safety testing your firewall. It is recommended that all ports in stealth, but I have 80 and 443 closed, which seems to be unsafe.

What do you think ?. Is it safe to be closed or is it better to be stealth?

How can I put them in the windows firewall in stealth mode ?, or, it will another firewall necessary?

Thank you in advance for your help

Hello Sr Normal,

Use stealth if possible...it is better.

However, if you are using a cable/DSL or NAT router then the Shields UP! tests are very likely to be erroneous plus, using a NAT, your system is protected against probes/penetrations as the router employs stateful packet monitoring (Google for explanation). In that case all you really need from a security perspective is a means to monitor outbound connections.

If your system sits behind a router then it can be accurately tested by using another system and a LAN...or you can setup port forwarding on your system (Unless you are advanced user then don't...it is needless plus you can break your internet connection by messing about with the router configuration).

You can check if you are behind a NAT router by Run cmd.exe and then type "ipconfig" without quotation marks and hit enter. If the Default Gateway/IP address (typically IPv4) begins with 192.168. then you likely are using a NAT router.

I have NAT and use EIS' firewall only to monitor outbound connections.

Hope this answers your questions.

 

[viktik]

many times home computers connecting to internet is behind NAT and is not directly reachable from internet. Since your home computer is not directly reachable from internet, no one can do a port scan on your computer from internet.

In this case when you try to test the firewall using some web service , the test will be done on your ISP router/NAT device and not on your home computer.

So the firewall of router/NAT device with ip address 145.12.131.7 will be tested

Example : here is pcfank advanced port scanner test result . I am behind NAT . so this is not testing my computer firewall. It is showing result of my ISP port scan. All post is stealthed , except port 80 . Port 80 is for web services . I don't have any website server in my computer. It is my ISP which is running web services

Check the ip address assigned to your adapter .
If it is between these range then you are Behind NAT

• 192.168.0.0 - 192.168.255.255
  
• 172.16.0.0 - 172.31.255.255
  
• 10.0.0.0 - 10.255.255.255

More info : https://www.grc.com/nat/nat.htm

 

[hjlbx]

Viktik's explanation is better...much.

 

[Sr. Normal]

The two explanations are very good ... and very reassuring.

I actually have the IP 192.168, which as I have described is NAT. I thought I could have an infection on your computer, or just a bad configuration.

Thank you very much to you, both for your help is greatly appreciated. @viktik i do not need know English to understand you. Perfect.

 

[marzametal]

However, if you are using a cable/DSL or NAT router then the Shields UP! tests are very likely to be erroneous plus, using a NAT, your system is protected against probes/penetrations as the router employs stateful packet monitoring (Google for explanation). In that case all you really need from a security perspective is a means to monitor outbound connections.

I have NAT and use EIS' firewall only to monitor outbound connections.

Thanks for the explanation, was a bit worried when I saw open ports. I was about to create a rule in W7F, adding all open ports to the rule and whatever happens happens.. lucky I read your post twice! W7F + use Windows Firewall Control to monitor outbound. Peerblock also helps.

EDIT: I might have to bring this topic up with my VPN. I ran the test while on my ISP connection, and I got all green. I connected to VPN, and received mixed results.

 

[hjlbx]

BiniSoft Windows Firewall Control ...

Best $10 I ever spent.