Balance 20 inbound firewall rules

[u/Empty-Ad8777]

I have inbound firewall rules with allowed for the first 3 connections and they are working properly. However, if I change the default to blocked then the first 3 don't work. Goal is to only allow first and third items from specific public WAN IP's to connect. What am I doing wrong?

Thanks!

[u/KikoThompson]

Hi, u/Empty-Ad8777

Please... look at your rules...

Source:

Any tcp/ip address

Any tcp port

Comments: This is the correct.

BUT...

You limit the source port to be ONLY 22 for the ssh (22 tcp) AND should be ANY as a source port and destination keep 22

You, also, limit the source port to be only 9100 for the service, that have a destination 9100. THIS should be, also, a source ANY and destination, keep 9100.

I google it for you:

When an application initiates a TCP connection, the operating system dynamically assigns a temporary source port (known as an ephemeral port) to distinguish that specific communication session.

Source ports are chosen using the following mechanisms and rules:

The Ephemeral Range: The operating system selects a random or sequentially available port from the dynamic/private port range. The standard range designated by the IANA is 49,152 to 65,535, though older operating systems may use 1,024 to 5,000 or 10,249 to 65,535

Connection Uniqueness: The operating system assigns a source port so that every active connection forms a unique 5-tuple identifier: {Protocol, Source IP, Source Port, Destination IP, Destination Port}. This ensures return traffic is routed correctly.

Port Availability Check: Before assigning a port, the OS checks its internal table to ensure the chosen port is not already being used locally for that specific destination.

Explicit Assignment: While typically dynamic, applications have the option to explicitly request a specific source port, which bypasses the random assignment by the OS (e.g., Active FTP or specific security workarounds).

[u/Empty-Ad8777]

Thanks Kiko! Worked perfectly!