RE: Which ports for http?

Thomas Svenson
Sun, 25 Jan 2004 11:58:42 -0000

the_activ@activ.dhs.org wrote:
> I''m trying to make my shorewall only allow access to http.
> So I made a default reject policy and rules to allow port 80 and 443
> outgoing. Now I know http uses other ports but I have no clue which
> ports I also need to open. Sorry for my ignorance but please help me,
> I tried lot''s and got nowhere.

Yes they can use other ports. As standard though http uses port 80 and https
uses port 443.

The only need you have to open other ports is if the server you are running
or want to connect to, is configured to use other ports than these two. If
you use a proxy server (such as squid on port 3128) you will have to open
that port though. If you want all traffic to go through the proxy you will
have to configure you fw so only that have access to the net and your
internal traffic can''t access the net direct on ports 80/443.

It is common to use other ports, such as 8080 or 8081, for dev environments
and so on. If that is the case you will have to open those ports too. There
is no standard here and virtually any port, though you should not use ports
up to 1024, can be used for http/https, it all up to what is configured in
the webserver.

To this you also have other applications such as SWAT (samba) and webmin
that provides a browser gui. They normally use ports 901/10000. If you have
any of them you will need to open up for them to. I use both, but they are
only accessible from inside the firewall, not outside.

Hope this helps,
/Thomas