Instruction 04-ports-protocols-and-host-firewalls: Reading

A network service is not identified by a port number alone. A complete endpoint includes an address, a transport protocol, and a port. TCP port 443 and UDP port 443 are separate endpoints because TCP and UDP maintain separate port spaces. The address also matters: a process bound to 127.0.0.1 is reachable only through the local loopback path, while a process bound to an address assigned to a physical or virtual network interface may be reachable from other systems. A wildcard bind can cover multiple local interfaces and therefore creates a larger exposure than a loopback-only bind.

TCP is connection-oriented. Before application data is exchanged, endpoints establish a connection, and the operating system tracks its state. TCP provides ordered delivery and retransmits missing data, but those features do not make the application secure; confidentiality and authentication require higher-layer protections. UDP sends independent datagrams without a connection handshake. It has lower protocol overhead but does not guarantee that a datagram arrives, arrives once, or arrives in order. A stateful host firewall may still track a temporary flow for UDP even though UDP itself has no connection state.

A host firewall evaluates traffic at the individual machine. Its policy can consider direction, interface, source and destination addresses, protocol, ports, and observed connection state. Rules are commonly processed according to an implementation-defined order, so policy authors must understand precedence rather than merely collecting allow and deny statements. A useful baseline is to permit established return traffic, narrowly allow required new inbound services, and use an intentional default action for everything else. Outbound filtering may also be appropriate for servers, appliances, and tightly controlled environments.

A firewall allowance does not create a service. If TCP port 18080 is allowed but no process is listening, a client still cannot use the service. Conversely, a listening service is not proof that remote clients can reach it: the service may be bound only to loopback, blocked by a host policy, blocked elsewhere in the path, or hidden behind routing and address-translation boundaries. Troubleshooting should therefore separate four questions: is the application running, where is it bound, does local communication work, and does policy permit the intended path?

Rules should describe a service requirement rather than a vague desire to make an application work. For example, allowing new TCP traffic to one administration port from a dedicated management subnet is narrower than allowing every protocol and port from every address. Record the reason, owner, source scope, destination port, and expected lifetime of an exception. Test administrative access before and after any real firewall change, preferably with an independent recovery path. This class does not alter the real host firewall. Instead, it creates loopback listeners and evaluates sample packet descriptions against a deterministic policy model stored entirely under the classroom directory.