Does port forwarding a port on one computer expose other computers in the network as well?

Question

I have read that port forwarding exposes your computer to security breaches. Does port forwarding a port on one computer expose other computers in the network as well?

Answer 1

You can consider your router the perimeter between those machines you trust and those you don't. When you port-forward, you are permitting access from machines you don't trust to one that you do. This automatically lowers the trust of your machine. This is warranted because when you are port-forwarding you are saying that it is acceptable for a machine that you don't trust to influence the behaviour of one that you do trust, each time a connection is made to it.

While you may only permit access to a specific service on your machine and so influence should be confined to a known quantity (such as serving a web page), there are no guarantees that there are no exploitable vulnerabilities in the application you are allowing to be accessed by external parties. If a vulnerability exists and is exploited, the worst case is that someone else has control of your machine. If they have control of your machine, then they can use it as a jumping point to probe other machines in your network for vulnerabilities.

This is why in corporate environments, efforts are made to ensure that any machine that will be directly accessed from the internet is segregated from the rest of the network via firewalls. This can help limit the ability of an attacker to get further into the network.

So this is the risk you must accept, and help better define the risk, you would need to examine the history of the application being exposed - how frequently critical vulnerabilities are uncovered, and how quickly they are addressed.

Mitigation strategies you can employ are about reducing your exposure. This can be done by only port-forwarding when you want to use the service, or closing the application when not needed.

Answer 2

If we accept the assumption that opening a port to a machine allows that machine to be compromised, then yes. Every port on a machine is open to every other machine on the same network. So if opening port X to machine Y risks a compromise of machine Y, anyone who has compromised machine Y has access to port X on machine Z. So they can compromise machine Z too.

But this really just shows that talking in generalities such as "exposes to security breaches" is really just too vague to be useful. Plugging a machine in exposes it to security breaches. Dealing with non-quantified levels of risk leads to silly conclusions.

Answer 3

No it does not - at least not generally. But if you forward some port to one machine there is a higher chance that this particular application gets attacked/exploited. During this it may run malicious code like a worm/trojan which then can spread in your internal network

Answer 4

Not really. Without port forwarding, incoming packets are dropped by the router because it cannot determine the destination. By forwarding ports, those packets are directed towards a specific machine. This is generally harmless. Your firewall will drop unwanted packets anyway. Even if it does not, no programs will be listening to that particular port and the packet will not affect the machine, of course with the exception of the program you had the port forward set up for in the first place, but that is intended behaviour.

The program you're using might have security flaws. An open port will allow an attacker to exploit these flaws. Not opening the port will add a level of protection by making the machine less accessible from the internet, but that itself is probably counterproductive. It is the equivalent of the very effective security measure of keeping a computer powered down forever.

Other machines in your network will not be exposed to such attacks; they are still inaccessible to the outside world, regardless of ports you may forward to their neighbours. The risk lies in the fact the exposed machine may be compromised. Machines normally protected by a layer of NAT will then be vulnerable because of an untrusted host on their local network.

In part, it is for this reason NAT is generally not regarded as a strong security layer anyway and punching holes in it should not put your network at risk. Nevertheless, it may be wise to set up a VPN instead of a port forward, in case your application is only used by trusted machines. More generally, be careful about which hosts are deemed trustworthy.