Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I opened port 25374, this is eMule TCP port, then I use to check if it is really opened.

I got the weird problem :

when eMule was running, saw my port. I got the message : "Success: I can see your service on on port (25374) Your ISP is not blocking port 25374"

When I closed eMule then checked the port again on I got : Error: I could not see your service on on port (25374) Reason: Connection timed out

But when I turned off the windows firewall I got a different error : Error: I could not see your service on on port (25374) Reason: Connection refused

Can anyone please explain to me why it happened like that and how to make the port always opened ?


share|improve this question
It's only going to appear "Open" when something is answering (ie: eMule). – Ƭᴇcʜιᴇ007 Apr 8 '12 at 15:52
up vote 2 down vote accepted

Your portforwarding is working as expected. There's just a difference between:

  1. a forwarded port
  2. an open port
  3. a closed port
  4. a blocked port

Port forwarding is just a feature of your router that tells it to route packets to a specific port to a specific host. It will do that whether or not the destination host's port is actually open or closed.

If the destination host has the destination port closed, the router will still forward any connection request packets to the destination host, but the destination host will respond back with a RST packet telling the remote host that the port is closed instead of a SYN-ACK response to proceed with the connection. (This is the mechanism a TCP SYN ping is based on, and it's how many portscanners work.)

However, if the port is actively blocked by a firewall, then even the RST response may be blocked. So the network activity will look like this:

  1. The external host sends a SYN packet to the router (first step in a TCP connection request's 3-way handshake).
  2. The router receives the SYN packet and reroutes it to the destination host.
  3. The destination host receives the SYN packet, but it gets blocked by Windows Firewall. Even if eMule were running, the application wouldn't receive the connection request.
  4. The external host waits for a RST or SYN-ACK response telling it that the destination port is closed or the connection request has been accepted; however, nothing happens....
  5. Eventually, the external host's client application decides it's waited long enough, and the connection times out.

This is a characteristic of firewalls that simply drop traffic. A firewall that rejects traffic will still send an RST response or an ICMP destination unreachable. However, this exposes more information about the network to potential attackers, which is why some network admins prefer simply dropping blocked traffic.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .