Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have read that port forwarding exposes your computer to security breaches. Does port forwarding a port on one computer expose other computers in the network as well?

share|improve this question
up vote 3 down vote accepted

You can consider your router the perimeter between those machines you trust and those you don't. When you port-forward, you are permitting access from machines you don't trust to one that you do. This automatically lowers the trust of your machine. This is warranted because when you are port-forwarding you are saying that it is acceptable for a machine that you don't trust to influence the behaviour of one that you do trust, each time a connection is made to it.

While you may only permit access to a specific service on your machine and so influence should be confined to a known quantity (such as serving a web page), there are no guarantees that there are no exploitable vulnerabilities in the application you are allowing to be accessed by external parties. If a vulnerability exists and is exploited, the worst case is that someone else has control of your machine. If they have control of your machine, then they can use it as a jumping point to probe other machines in your network for vulnerabilities.

This is why in corporate environments, efforts are made to ensure that any machine that will be directly accessed from the internet is segregated from the rest of the network via firewalls. This can help limit the ability of an attacker to get further into the network.

So this is the risk you must accept, and help better define the risk, you would need to examine the history of the application being exposed - how frequently critical vulnerabilities are uncovered, and how quickly they are addressed.

Mitigation strategies you can employ are about reducing your exposure. This can be done by only port-forwarding when you want to use the service, or closing the application when not needed.

share|improve this answer

If we accept the assumption that opening a port to a machine allows that machine to be compromised, then yes. Every port on a machine is open to every other machine on the same network. So if opening port X to machine Y risks a compromise of machine Y, anyone who has compromised machine Y has access to port X on machine Z. So they can compromise machine Z too.

But this really just shows that talking in generalities such as "exposes to security breaches" is really just too vague to be useful. Plugging a machine in exposes it to security breaches. Dealing with non-quantified levels of risk leads to silly conclusions.

share|improve this answer
I agree, dealing with non-quantified information always leads to sillier or at least as silly conclusions then non-quantified information, but to understand anything I need to make assumptions. At least that is the fastest way of learning imo. Even if my assumptions are wrong, I think the most import thing is that you explicify hypotheses as much as possible in your mind and test them consequently. But will you only act on situations you can completely quantify? Thanks for your answer! (and also of the other pple who commented) – Bentley4 May 13 '12 at 11:50

No it does not - at least not generally. But if you forward some port to one machine there is a higher chance that this particular application gets attacked/exploited. During this it may run malicious code like a worm/trojan which then can spread in your internal network

share|improve this answer

Not really. Without port forwarding, incoming packets are dropped by the router because it cannot determine the destination. By forwarding ports, those packets are directed towards a specific machine. This is generally harmless. Your firewall will drop unwanted packets anyway. Even if it does not, no programs will be listening to that particular port and the packet will not affect the machine, of course with the exception of the program you had the port forward set up for in the first place, but that is intended behaviour.

The program you're using might have security flaws. An open port will allow an attacker to exploit these flaws. Not opening the port will add a level of protection by making the machine less accessible from the internet, but that itself is probably counterproductive. It is the equivalent of the very effective security measure of keeping a computer powered down forever.

Other machines in your network will not be exposed to such attacks; they are still inaccessible to the outside world, regardless of ports you may forward to their neighbours. The risk lies in the fact the exposed machine may be compromised. Machines normally protected by a layer of NAT will then be vulnerable because of an untrusted host on their local network.

In part, it is for this reason NAT is generally not regarded as a strong security layer anyway and punching holes in it should not put your network at risk. Nevertheless, it may be wise to set up a VPN instead of a port forward, in case your application is only used by trusted machines. More generally, be careful about which hosts are deemed trustworthy.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .