Many services use random ports above 1024. If you want to be realistically functional, you can not assume you can block all those ports incoming.
Port 20 is the data port on one end, but it is connecting to a random port in the 1024+ range on your end in order to communicate.
The previous comment is also correct, toggling passive mode will get you around firewalling issues usually, specifically with ftp.
But other programs, like games, citrix, terminal services, etc do this as well. Recommendation: if you want real firewalling, you have to use a seperate box between you an the net to do the filtering. Then nat takes care of connection you need, while explicit connections to you are primarily impossible, and to the external box are pointless. |
