Network Port Number Reference

The three ports that cause most breaches

If you only check three things on a firewall, check that 3389, 445 and 22 are not open to the whole internet. Remote desktop on 3389 is scanned continuously by automated tools that try common passwords all day, and it is the most frequent way ransomware reaches a business network. Windows file sharing on 445 is how that ransomware then spreads once it is inside. SSH on 22 is safer because it can be configured properly, but only if password logins are switched off and keys are used instead.

None of these need to be public. A VPN puts all three behind a single encrypted door that does not answer strangers, and it is the one change that removes the largest amount of risk for the least effort.

Databases are never a public service

Every database port in the list above is marked internal only, and that is not caution. MongoDB, Redis and Memcached all shipped for years with no authentication enabled by default, and tens of thousands of them were found, emptied and held for ransom by people doing nothing more sophisticated than scanning the internet. A database should listen on localhost or on a private address that only the application server can reach. If a hosting provider tells you otherwise, that is worth questioning.

Cameras and recorders deserve special suspicion

CCTV equipment is the worst offender in most buildings. Recorders are routinely installed with the port forwarded straight through the router so the owner can watch from a phone, often with the factory password still set and firmware that has never been updated. Public search engines index these devices, which means anybody can find them. Remote viewing is reasonable to want. Do it through a VPN or the manufacturer's cloud relay rather than by opening the recorder to everyone.

A closed port tells an attacker less than a filtered one

There is a difference between a port that refuses a connection and one that never answers. A refusal confirms there is a live host at that address. Silence tells a scanner nothing, which is why a firewall should drop unwanted traffic rather than reject it. It is a small configuration detail that makes your network considerably less interesting to automated scanning.