making closed ports invisible

[sag]

I have ZA and a router firewall. I went to Gibson Research and ran his port scanner...it shows all ports are either closed or in Stealth mode. How can I make all ports Stealth? I have ZA set at the highest level of protection.

[mjc]

ZA should be enough to show all ports "stealthed" but the router is probably the reason some show closed.

You are fine, there is no need to actually show everything "stealth". It just looks cool, there is no extra advantage to having them so.......

[sag]

The only reason I felt the need to "Stealth" all the ports was because of the Port Scanner probe at Gibson Research that said I failed the tests including being pinged and that even though the ports are closed, they still respond to the world that they are there. So some slug with a scanner and not much else to do might be able to find a way do what ever. Gibson seems to say that the best defense is to be invisible. Is this reasonable or just overkill?

[John0904]

I agree with mjc and say it is definably your router.

Even without a software firewall and just relying on your router, you should show stealth across all ports. At least for me it does.

With my router, port 113 by default is closed. I had to forward that port to a non-existing private IP address (192.168.0.255) so it became stealthed. In addition, I had to disable the ping from WAN side.

You'll need to examine your router settings and see how it is setup.
You should find your answer from the manufacturer web site. Use the search feature there and look for Stealth and or Port.

[sag]

Thanks for the input...I went to the router firewall settings and changed Block WAN request from disabled to enabled and all ports are now stealth except 113 like yours. What is port 113 for and how can you direct it to a fake IP and not cause a problem?

[John0904]

http://grc.com/port_113.htm

Not sure what you mean by, "direct it to a fake IP".
Unless you mean forwarding to a "private IP".

In which case you basically open that port to a "inside" IP address. Like, open that port and point it to 192.168.0.255

Make sure that 192.168.0.255 is not a valid machine IP address.

You'll have to read the manual on how to open/close ports for your particular router.

[sag]

Poor choice of words...I did mean private IP. I know how to change the forwarding of ports in my router setup...and I had read the article on GRC, that's why I was somewhat concerned about pointing 113 to a non-existent IP. I guess you have not had any problems. I must say that I (right or wrong) feel much more secure with at least all but one port in Stealth mode.
Thanks for the advise.

[jabarnutcase]

And if you happen to have a Linksys....More info on port 113 near the end of This Article

(Basically elaborates on what John0904 was talking about)


By the way....What kind of Router do you have? (I'm using a Linksys and all my ports are "stealthed")

[John0904]

I understand your concern about opening ports on the router.

What is special about this is that you are directing this particular port to the "inside" network.

As Steve Gibson explained:
The trick is to use the router's own "port forwarding" configuration options to forward just port 113 into the wild blue yonder. Just tell the router to forward port 113 packets to a completely non-existent IP address, one way up at the end of your router's internal address range. The router will then NOT return a port closed status. It will simply forward the port 113 packet "nowhere" . . . and your network will be returned to full stealth status.

Even though you are opening a port in this manner, the outside has no access to it. Period.

And jabarnutcase,
If I were to guess, he has a DLink. My last DLink did the same thing. I think that all DLink have port 113 closed by default.

[sag]

I have been away from my computer for a few days...So let me catch you up. Yes I have a Linksys. And thanks for all the advice...I forwarded port 113 and now it is in stealth mode. Hope that there will be no adverse consequence to "stealthing" 113...have not seen any problems as of yet.
sag

[jabarnutcase]

My Linksys has been fully "Stealthed" for Months sag...No problems whatsoever.

Thanks for the update.

[sag]

That's good to know.
Thanks
SAG