Source Address / Source Port vs Destination Address / Destination Port

Question

I am new to TCP/IP and trying hard to learn basics. Well, I really wonder about inbound rules and outbound rules of firewall and concept of source address port, destination address port.

For example, I am investigating port 80. I know that Http uses port 80. But when I try to listen the traffic I see that my browser doesn't use port 80. As you see from the image only destination port 80 is used and "destination" should be the server that hosts web pages. And also there is no used port 80 on source port, "source" should be my computer.

My browser uses some other ports as a source and goes to the server port 80. From that, I understand that port 80 of my computer is not used for Http, only server computers that host the web pages use port 80 but if I close port 80 of my computer from outbound rules the internet doesn't work. But as I understood before from the image, port 80 is not used on my computer.

Really confused. Can anybody clarify it for me?

Answer 1

OK, so let's dive into the details of IPv4. Each IP packet has a source IP address and port and a destination IP address and port. An IP address is for the whole computer, so the IP address is enough to bring a packet from computer A to computer B. If you have two services running on one computer like eMail and Webserver the IP packets need to reach the right service. The selection of the right service is done based on the ports.

If a client wants to connect to a server like a webserver or a mail server, then the client needs to know the IP address of the server. In a web browser you enter the DNS name or the IP address of the server. In a mail client it was also you that entered the name of the mail server. So when the client wants to connect to the server, the only thing missing is the port. To make that easy, there are standards that define which port is used/reserved for which service. For http for example port 80 is reserved. A webserver is only listening on port 80 but ignoring any other ports.

If you want to, you can configure a webserver to listen to any port you want, it could also for example be port 12345. But then clients would need to enter http://ip:12345/ so the web browser knows on which port to contact the webserver. Just giving http://ip/ would be a short cut for http://ip:80/.

So as you have seen, the server is working on a well defined port, he is receiving packets sent to destination=server-ip:server-port and sending packets with source=server-ip:server-port. On the cient side the operating system is opening a new socket for each new connection and assigning a unique (not yet used) port to the socket. Which port is used is not relevant. The client is the one who is initiating a connection, he sends packets with source=client-ip:client-port to the server. The server can look at the packet's source and now knows who is connecting him and where he shall send back the answers.

Each quadruple server-ip:server-port:client-ip:client-port uniquely identifies a connection.

Clients view connections as outgoing, servers view them as incoming. Firewalls can have outbound rules (sending packets) and they can have inbound rules (receiving packets). If you want to block http connections from/to your computer, the only thing you know is the port that the server is using. So when you want to block web browsers on your computer, then you must define a deny outbound firewall rule for destination=port 80. If you want to block other computers so they can't connect a web server that you are running on your computer, then you must define a deny inbound firewall rule for destination=port 80.

Some more stuff you didn't ask for:

• Not every service has a designated/reserved IP port.
• There are also protocols for special service discovery procedures.
• The (16 bit) range of ports is divided into two parts. Port numbers 1-1024 are reserved for admin/system processes while higher port numbers can be used by anyone.

Answer 2

You're closing outbound connections TO port 80, you gotta remember that outbound connections are going to servers like Google, StackOverflow and other websites/whatever.

Your browser makes connections to the other servers on port 80 and by you blocking that you're stopping your browser making that connection.

Say someone connected to your IP via their browser, that would be classed as incoming traffic on port 80 (or 443 for https) TCP, if you block that port for incoming traffic, then they wont be able to connect to it.

Say you connected to an IP or DNS record via your browser, that would be classed as outgoing traffic on port 80/443 TCP, blocking that port on outgoing will result in no connection being made to that server.

Answer 3

Port explanation

2 common port for web servers: 80, and 443 (for secure HTTPS connection).

Port 0 - 1024 are 'reserved' port that are used for commonly used function, in which case 80 and 443 for HTTP and HTTPS. This Wiki entry shows the list of all those ports, and the 'usual' use of those ports. You can override those ports for your own use, but often not recommended. Note: The wiki goes all the way to 65536 but the reserved port (are only from 0 to 1024)

If you set Firewall on OUTBOUND rules to BLOCK port 80, then any outgoing connection to Port 80 are blocked, therefore any HTTP requests are blocked. Port 80 is used to go OUT. And you blocked that. But if you are checking secure sites (sites that uses HTTPS) it will still work, unless you block OUTGOING port 443 as well.

Browser Explanation

Your browser is NOT a web server, therefore your browser does not have Port 80 Open for others to connect to. If you have port 80 open on your computer, you may want to check that you are running a web server. If you are not knowingly running a web server but port 80 is open, best to check your PC for possible spyware/virus/adware.

The reason why your browser have those seemingly random port number, is that the OS need a way to identify every different connection that goes out. So the OS assign a random port number above 1024 (or some arbitrary number usually over 10000) for every outgoing connection done by the software on your PC. The reason for the port assignment is to identify incoming data returned by web server, or whatever other server you are connecting to. The OS need to know where to return the data, whether it goes to your Chrome browser, or some other software that requires internet access.

Once the port number goes all the way up to 65536, it will simply go back to 1025 (or maybe some random arbitrary number set by the OS) and goes all the way up again.

I hope this clears things up for you.