0

I opened port 25374, this is eMule TCP port, then I use canyouseeme.org to check if it is really opened.

I got the weird problem :

when eMule was running, canyouseeme.org saw my port. I got the message : "Success: I can see your service on xxx.xx.xxx.xx on port (25374) Your ISP is not blocking port 25374"

When I closed eMule then checked the port again on canyouseeme.org I got : Error: I could not see your service on xxx.xx.xxx.xx on port (25374) Reason: Connection timed out

But when I turned off the windows firewall I got a different error : Error: I could not see your service on xxx.xx.xxx.xx on port (25374) Reason: Connection refused

Can anyone please explain to me why it happened like that and how to make the port always opened ?

Thanks

ITFan
  • 836

1 Answers1

2

Your portforwarding is working as expected. There's just a difference between:

  1. a forwarded port
  2. an open port
  3. a closed port
  4. a blocked port

Port forwarding is just a feature of your router that tells it to route packets to a specific port to a specific host. It will do that whether or not the destination host's port is actually open or closed.

If the destination host has the destination port closed, the router will still forward any connection request packets to the destination host, but the destination host will respond back with a RST packet telling the remote host that the port is closed instead of a SYN-ACK response to proceed with the connection. (This is the mechanism a TCP SYN ping is based on, and it's how many portscanners work.)

However, if the port is actively blocked by a firewall, then even the RST response may be blocked. So the network activity will look like this:

  1. The external host sends a SYN packet to the router (first step in a TCP connection request's 3-way handshake).
  2. The router receives the SYN packet and reroutes it to the destination host.
  3. The destination host receives the SYN packet, but it gets blocked by Windows Firewall. Even if eMule were running, the application wouldn't receive the connection request.
  4. The external host waits for a RST or SYN-ACK response telling it that the destination port is closed or the connection request has been accepted; however, nothing happens....
  5. Eventually, the external host's client application decides it's waited long enough, and the connection times out.

This is a characteristic of firewalls that simply drop traffic. A firewall that rejects traffic will still send an RST response or an ICMP destination unreachable. However, this exposes more information about the network to potential attackers, which is why some network admins prefer simply dropping blocked traffic.

Lèse majesté
  • 3,301