From what little I know about networking, opening ports lets external data get sent in. But how that data is handled is entirely up to the applications running on my machine. So if I'm not running any malicious applications, there should be nothing wrong with disabling the firewall, right? Also, how do applications work when ports aren't forwarded? For example, I need to forward port TCP 6112 to host Blizzard games, but I've heard that HTTP uses port 80, but I haven't forwarded that port, yet Firefox still works. Btw I'm using Windows Vista.

  • 1
    Firewalls block incoming connections. If you request a web page, that would be an outgoing connection. – Hasaan Chop Nov 23 '09 at 20:00
  • Actually, most firewalls are capable of blocking/allowing incoming and outgoing connections. – alfplayer Nov 23 '09 at 23:12

Technically speaking, the only dangerous open port is one on which there is malicious software accepting connections without your knowledge. An open port in your firewall (allowing incoming connection requests) is not a threat at all if there is nothing on your side of the firewall listening for those requests.

The reality is that we all need to run multi-layered security which includes closing "unnecessary" ports so that they cannot be co-opted by malicious software. I.e. you would never knowingly install malicious software which would answer those inbound connection requests, but that's part of the social engineering aspect of malicious software: finding a way to convince people to install it so that it can find those open ports and hijack them.

In essence, opening ports isn't "bad", it's just necessary and should only be done individually on a case by case basis.


HTTP uses port 80 for listening on the server side (incoming connections). You aren't hosting a web server, using Firefox to browse is different (outgoing connections). I'd keep the firewall on regardless. You're right in the aspect that an application needs to be listening, but if you download malicious software you've made that aspect even easier for the writer of the software to connect back and communicate with an IRC server for example to control your machine. Since the ports are already open, it can communicate on pretty much any one it wants with the exception of used ports.

If you're hosting a service (game server for example) you'll need to open ports for other users to connect. Since it's trusted software you have listening for connections there shouldn't be a problem. If you want to be extra cautious though, disable the port forwarding rule in the router when you're done with the server.

  • I vote this up. Applications connecting to internet usually establish outgoing connections. Most applications in a desktop pc don't listen for connections because there is no need for other computers or applications to start a connection to them. Also, this question and answer apply to all operating systems. – alfplayer Nov 23 '09 at 23:41
  • HTTP typically uses port 80 on the server side, but it can use any port. Say 7600. – Peter Mortensen Feb 3 '10 at 23:30

Not unless you know what ports and who'll be using the ports.

Port opening is necessary if you want to do it manually, if not that's what UPnP is for. But I strongly advise against UPnP.

I'd like to think manually opening ports is safer than allowing applications do it for you.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.