3.4 Ports, Services, Firewalls, and Basic Traffic Flow
Ports are the delivery slots of a host
An IP address names a machine; a port names a process on that machine. Ports are 16-bit numbers, so TCP and UDP each have 0 through 65535. Numbers below 1024 are the well-known range on Unix and normally need privilege to bind, and Linux hands out client-side ephemeral ports from 32768 to 60999 by default. A connection is identified by a five-tuple: protocol, source address, source port, destination address, destination port. That is why two tabs to 192.0.2.1:443 stay distinguishable: their local ports differ, e.g. 49152 versus 49153.
Services, sockets, and what a scan really sees
A service becomes reachable when it calls bind() and listen() on a socket. Binding to 0.0.0.0:8080 exposes the service on every interface; binding to 127.0.0.1:8080 exposes it to nothing outside the host, and that single difference removes a whole attack class. Inspect the real state with ss -tulpn, which lists listening sockets and owning processes. A port scan is not a special protocol: a SYN scan sends SYN and reads the reaction, so an open port answers SYN-ACK, a closed port answers RST, and a filtered port answers nothing because a firewall discarded the packet. Common targets to inventory are 22 SSH, 25/587 mail, 53 DNS, 80/443 web, 3389 RDP, and database ports such as 3306 and 5432.
Firewalls decide, and statefulness decides well
A firewall evaluates each packet against an ordered ruleset, first match wins. A packet to 192.0.2.1:443 from an arbitrary client can be accepted because a rule reads "allow tcp dpt:443 NEW"; a packet to 192.0.2.1:3389 matches no allow rule and reaches the default policy, DROP, so it vanishes with no reply. A stateful firewall additionally keeps a connection table, so the reply to an allowed outbound request is accepted by the ESTABLISHED rule rather than by an inbound hole. In iptables terms that is -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT, which lets you keep inbound policy deny-everything-else. Firewalls cannot read encrypted payloads, so a proxy or WAF in front of 443 is a different control.
Following one packet end to end
Trace the path: your host sends a segment to 192.0.2.1:443; the LAN gateway decrements TTL, applies NAT, and consults its forward rules; the destination host delivers the segment to whichever process owns port 443. If nothing is listening, the kernel sends RST. If the perimeter drops it, you only see a timeout, which is exactly why "connection timed out" usually means filtered while "connection refused" means reachable but closed. Debug with nc -vz 192.0.2.1 443 and read the wording of the failure.
Architecture Diagram
Key Takeaways
- A five-tuple identifies a flow; ports separate processes on one IP address.
- Bind to
127.0.0.1instead of0.0.0.0whenever a service is local only. - Timeout means filtered, refused means closed but reachable; that distinction guides triage.
- Ordered rules with a default
DROPpolicy plusESTABLISHEDstate is the safe baseline. - Firewalls filter headers, not encrypted payloads; content inspection needs a proxy or WAF.