选择Windows机器上的TCP端口，如果需要（以编程方式）添加防火墙例外？

Question

Thank you for reading my post.

Can you help me interpret what the following line from "netstat -anb" means:

Proto Local Address Foreign Address State TCP 192.168.2.241:52440 64.233.166.103:443 ESTABLISHED [firefox.exe]

In particular:

• does this mean that the TCP port 52440 is opened on the machine which IP is 192.168.2.241?
• does this mean "firefox.exe" is bound to this port?

Can you guess how "firefox.exe" knew it could use this port (without interfering with another program already bound to that port)?

As a matter of fact, "firefox.exe" is using a lot of ports. For example, right now on 192.168.2.241, "firefox.exe" is using the ports nro 52163, 57019, 57022, 57030, 57045, 57046, 57049, 57051.

I am asking all this because I would like to write a program which binds to a TCP port to enable communication between the machine where the program is installed and a remote machine on the Internet using sockets.

Contrary to "Firefox" I need only one TCP port on the machine where the program will be installed.

I only need this mechanism to work once, the first time the program is executed (this is not a permanent feature of the program).

• How can this port be chosen?
• How can this port be chosen programmatically (not manually)?
• If there is a firewall preventing the use of any port/the chosen port, how is the program going to behave?
• Can an exception be added programmatically to the firewall to open this port?

The machine running the program is a Windows machine.

I would program this in C/C++.

Best regards.

Below is a complement to my original question.

Well, my apologies, maybe you're right: maybe it's wrong to add an exception in the firewall of the user... What I mean by "adding an exception in the firewall of the user" is doing something like this:

netsh advfirewall firewall add rule name="An exn" dir=in action=allow protocol=TCP localport=6667 program="where/the/program/is/stored/prog.exe" enable=yes

Until now, I thought that, if an application was already "using" a TCP port for its own usage, no other application could "use" this very same port. (I'm aware of the fact that the word "use" is very imprecise. I'd be glad to be able to formulate things more accurately...) I'm saying this because, as I need a TCP port, I was wondering if I could use an "already available" TCP port... (When I say "already available", I don't exactly know what I mean (maybe I would like to say "open" and "bindable" / or a port already "used" by another application): I'm thinking about TCP port 80 which is often "available"... Again, I wish I could be more specific about this.)

Please let me try to reformulate what I'm willing to do.

1. A user runs a program "setup.exe" on its machine "M".
2. "setup.exe" sends a message "m1" to an Internet remote server "RS".
3. "RS" sends back some information "m2" to "setup.exe" running on machine "M" through a TCP port.

To be able to allow this bidirectional communication between "M" and "RS", I need to "have" a TCP port on machine "M" from which "setup.exe" can receive information sent by "RS". ("RS" is not a problem to me, I can do anything I want on it).

Given the fact that I know nothing about "M" a priori apart from the fact that it is a Windows machine (in particular I do not know what kind of firewall protects it, etc.), I don't really know how to handle the problem correctly. What I would like to avoid is having "setup.exe" fail silently without telling why the TCP port on machine "M" can't be "used".

Given the fact that I need to "have a TCP port available" for the program "setup.exe" running on machine M, what steps should I follow to make it as smooth as possible for the user.

Suppose I'm trying to "use" TCP port 6667, and suppose I'm not "allowed" to. Apart from a firewall, or another application already "using" this port, what could be the reasons why this port is not available?

I simulated the two machines "M" and "RS" basically using this code http://msdn.microsoft.com/en-us/library/windows/desktop/ms737889%28v=vs.85%29.aspx .

• I didn't add an exception to "M"'s firewall.
• The two programs on machines "M" and "RS" could communicate smoothly and correctly.
• But as you pointed it out in your first answer, "there are no outbound port rules in the firewall at all" on these test machines...
• So, I tried, as a simulation, to add an exception into the M's firewall in the section "Outbound rules" to block completely the connection to port TCP 6667 on machine "M": the scenario described above (steps 1) 2) 3)) fails in that case.

I hope this literature is not too indigestible and sorry for the approximations and misunderstandings.

Thank you for helping. Best regards.

Answer 1

does this mean that the TCP port 52440 is opened on the machine which IP is 192.168.2.241?

Possibly, but more probably it means there are no outbound port rules in the firewall at all, as there shouldn't be, being pointless.

does this mean "firefox.exe" is bound to this port?

It means that socket of firefox.exe is bound to that port. It can have many other sockets, and usually does.

I would like to write a program which binds to a TCP port to enable communication between the machine where the program is installed and a remote machine on the Internet using sockets.

You need to state whether your program is a client or a server. If it's a client, it's exactly like Firefox, and you don't have a problem. If it's a server, you have to bind to a port that is open for incoming in your firewall, and Firefox is completely and utterly irrelevant.

Contrary to "Firefox" I need only one TCP port on the machine where the program will be installed.

Sounds like a server, but you need to tell us. For simplicity I am assuming it's a server from here on.

I only need this mechanism to work once, the first time the program is executed (this is not a permanent feature of the program).

You don't need this mechanism to work at all. You need the user to open the port. The user won't appreciate software that breaks his firewall configuration, assuming you can do it at all, which you shouldn't.

How can this port be chosen?

By you. Choose it now. Use one that isn't reserved by IANA.

How can this port be chosen programmatically (not manually)?

You can specify port zero but then you have to tell the user so he can open it at the firewall.

If there is a firewall preventing the use of any port/the chosen port, how is the program going to behave?

Incoming connections won't succeed so the program will do nothing.

Can an exception be added programmatically to the firewall to open this port?

No idea, but it's a bad idea, see above.