Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is being asked in he context of a router that has no port forwarding enabled. I.e. no incoming connections accepted. Outgoing only.

I read something on a forum where someone said that whenever you as a client are behind a router, and connect to a particular host, then that opens up a port on your router and forwards ALL inbound traffic attempting to connect to the port, regardless of the source of that traffic, and thus while that connection is open it is just as insecure as if you setup port forwarding for that port. In other words, some malicious third party, that is coming from some other address besides the host, could connect to that port.

My understanding was that when I initiate an outgoing connection to a host, then the listening port is limited to communication with that host address. In otherwords, a third party's incoming connection would not be able to access that port. However, this one lone person seemed to imply that only a firewall did this. This kind of violates my understanding of how a connections works and how a router maps the listening port for an outgoing connection(I was going to add there's plenty of holes in my knowledge to violate, but then I realized that sounded really bad.).

Does a router limit an outgoing connection to communicating with the destination host? Or does the router also forward from other third parties that are not originating from the destination host if they try to connect to that listening port?

share|improve this question
Most Routers have built in firewalls that prevent connection from a 3rd party. – G Koe Mar 17 '12 at 3:37

I'm assuming that your router is doing NAT here (which most home routers do). In that case incoming packets will only be forwarded if they match a current NATed connection, which means that the source and destination IPs and ports must all match, so you are correct about only the relevant packets being forwarded.

Note that there isn't a listening port in this situation (i.e. there isn't a process which is accepting connections) -- the router is just routing and NATing IP packets.

Even if the router blindly forwarded packets not relevant to the connection, they would be discarded by the destination machine because they aren't part of an open TCP connection (and there can't be a process listening on that port because it's being used for an outgoing connection).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .