Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In order for my computers at work (behind a main router) to be able to browse to internet -

which ports (minimum) should I keep open to let them browse the internet ?

is it just 80 , 443 ?

share|improve this question
    
Are outgoing ports closed by default? –  Ignacio Vazquez-Abrams Dec 24 '12 at 22:14
add comment

4 Answers

up vote 3 down vote accepted

Yes, 80 and 443 will provide access to the vast majority of websites on the internet. However, there is no rule that requires websites to use these ports only. Many will use different ports, such as 8080, and you will need to add these as they arise (and a business case exists).

Another, perhaps better option, is to install a proxy server, and allow it to access the internet, and do not allow any direct access for the PCs. That way, you can ensure they only access websites, and you can also control what websites can be accessed. PCs would be configured to use the proxy server.

share|improve this answer
    
When I connect to the bank , Do the packets get out from port 443 in my comp TO the Bank computer's port 443 ? –  Royi Namir Dec 25 '12 at 16:24
1  
@RoyiNamir No. Packets have a source port and a destination port. The destination port is 443 for an SSL connection normally, and the source port is random (1024-65535). Firewall rules in most cases deal with destination ports only. –  Paul Dec 25 '12 at 20:44
    
I'd add, that the tcp destination port is set, from his comp prior to leaving it. Indeed I'd like to stress to the questioner, packets don't leave from a port, anymore than they arrive at a port, that is for ships to do. –  barlop Dec 25 '12 at 21:01
    
@barlop I don't think it is problematic to visualise packets as arriving on a port. –  Paul Dec 26 '12 at 0:51
    
@Paul It's not necessary to use a false concept, (one could visualise the correct concept), but if visualising the false one, then one has to correct his terminology so that it reflects that. Saying "block port 443" or block port anything, is then not really done in this case, and that confused him. You'd have to say it's blocking packets -destined- for port 443. His confusion came from a)his false concept which you thought was not problematic b)his correct terminology not working well with his false concept. –  barlop Dec 26 '12 at 1:50
show 3 more comments

For your computes to work to browse the internet you need no ports open at all. You only need to open ports if people are going to be connecting to you.

The router temporarily makes a port mapping (NAT) every time you make a connection outbound. If you are not running any web servers that you want people on the internet to connect to you do not need to open any ports on the router.

If your firewall is blocking outbound connections that's a different matter and you would need to set some rules to let connections through. However you asked about opening ports on a router and most consumer grade routers do not have firewalls that behave that way.

share|improve this answer
add comment

When talking of a router and ports open or closed, it normally means incoming and is talking of a NAT issue with a NAT Router. Routers often aren't just routers and tend to have basic firewalls built in, and even then, Outgoing are not blocked by default. If you just talk about open or closed ports especially with this question and these answers(where you're using that terminology for outgoing too), it's far clearer to say whether you mean open/closed incoming ports, or open/closed outgoing ports. A router needs no incoming ports open(hence some here have answered that a router needs no ports open, as that is normally what is meant when talking about open ports on a router). And needs outgoing ports 80(http) and 443(https) open(not blocked), in order to allow for browsing.

share|improve this answer
add comment

There is no single standard for open ports that allow you to navigate, because the network administrator can perform the customization you want. As mentioned by other members, 80 and 443 will allow access to most of the services that communicate with the outside of the network.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.