Firewall – Typical outbound port list for guest access

firewallnetworking

I manage a weekly rental house that includes wireless Internet access. I've allowed all outbound ports on my router but my ISP has disabled my Internet access twice now because guests have downloaded (or served up) copyrighted content. So I'd like to institute some port filtering to discourage p2p sharing (see disclaimer below). But I don't want to inconvenience the 99.9% of folks who keep things above-board.

My question is, what outbound ports are typically open for rental/hotel wireless Internet access, or where can I find such a list? TCP 80,443,25,110 at a minimum. Though my own email service uses 995 and 465 for SSL, some may use IMAP, I personally use SSH and FTP, so I'll open those. Roughly I figure I need to open access to privileged ports, and close 1024 & above. Is there a whitelist I should institute for commonly used high ports? And does it make sense to block UDP > 1024 ?

Disclaimer: I realize anyone replying to this message could circumvent the port filtering and share content to their heart's content. I do not need comprehensive p2p blocking, which requires more than a port whitelist. Anyone staying at the house shoulders the responsibility for their Internet use, per the rental contract. Also anyone savvy enough to circumvent the port filters would hopefully be savvy enough to use some sort of peer blocking, thereby preventing the ISP from taking down the service.

Best Answer

A general list of ports to open on "guest networks" which are relatively safe:

Outbound TCP:

53                  DNS unless you provide it (yes, TCP. Read the RFCs)
80, 443             Web Browsing
110, 995            EMail (pop3, pop3s)
143, 993            EMail (IMAP, IMAPS)
587                 EMail (SMTP Submission RFC 6409)

Outbound UDP:

53                  DNS again, unless you provide it
123                 NTP (Optional, but nice.)

Inbound TCP/UDP: NONE (Only established stateful connections from the above list)

As others have mentioned, bandwidth throttling may be a more effective way of dealing with torrenters.

As a non-technical measure to protect yourself from action (by your ISP or by copyright holders) you should also provide your renters with an acceptable internet use policy, noting that the renter's use of the internet access is their sole responsibility, illegal activity is not tolerated, and that violations of that policy will result in loss of internet access on this and all future visits.

There are template AUPs, but yours can be as simple or complex as you want, I recommend getting it down to one side of a regular sheet of paper.

Related Topic