Closing all the UDP ports?

[Sleidia]

Hello again

Can someone tell me whether it is recommended or not to close all the UDP ports used by IE and Outlook??

I've tried to do so on my firewall (OutPost), but as a result, I couldn't have access any website anymore. Is that normal?

I've noticed that several of those ports get opened from time to time ( even when opening google.com )

Thanks for helping

 

[ChrisAC]

DNS uses UDP 53. Better not block this one!

Chris.

**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[mbuell]

Chris:
>DNS uses UDP 53. Better not block this one!

Why not?

Maybe you can help me understand something related. UDP 53 is one of two ports that GRC shows open from my home lan machines. All home lan machines report the same. LAN is on small wireless router. In this case, if it is my machine that is reporting UDP 53 open, then I don't want that. My LAN machines get url internally from the router. If the report is only telling me that the router is listening to my ISP, well hey, ain't that what it should do?

Please elaborate about port 53.

Mark

Mark
<O>
_|_

 

[ChrisAC]

UDP 53 should only be open on your side if you are running a DNS server. I suspect that your router is maybe running a DNS cache server which is why a port scan shows that port open. I doubt that all your LAN PC's are running DNS!

When I said that you shouldn't block it, I meant that you shouldn't block it outbound, ie. your client need to be able to make outbound DNS requests.

Chris


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[mbuell]

Thx for reply.

My router IS running a DNS server for the LAN. I wouldn't think it should be open to the outside past my isp. I'll have to see if I can set a filter for this - only to my ISP. This would make sense, as my router does get my lan's url from my ISP's DNS server.

My boxes are NOT running DNS servers. Well, they are Windows, so I don't THINK they are running DNS servers. I have either shut this service off or set it to not run, so as near as I can tell they aren't. But that was partly why I went to GRC.

Thanks again for the reply. That was helpful.

Mark
<O>
_|_