Ports, TCP/UDP: The Grammar of Firewall Rules

The previous module settled the question of the address: it names a machine. What remains is how the same machine can offer several services at once, each reachable on its own: that is the job of the port, and of the grammar that describes a network flow.

An IP address tells a packet which machine it is headed for; it does not say which service. That is the port's job: a number that identifies one specific application on the destination machine. Port 80 identifies plain web traffic, port 443 encrypted web traffic, port 22 remote administration over SSH.

The transport protocol matters just as much. TCP first establishes a connection before exchanging any actual data, through a three-step handshake: SYN (I want to talk), SYN-ACK (agreed, go ahead), ACK (done). This handshake guarantees order and reliability in the exchange, at the cost of a bit of delay. UDP, by contrast, sends data straight away with no negotiation and no delivery guarantee: faster, but every lost packet is lost for good. DNS or live voice traffic can live with that trade-off; a file transfer or a web page prefers the reliability of TCP.

This handshake also explains what a port scan reveals, one of the first tools used in the lab. Probing a port gets one of three possible answers: a SYN-ACK signals an open port with a service listening, an RST signals a closed port that is still reachable, and total silence signals a filtered port, silently blocked by a firewall.

The Grammar of a Flow

Describing a network flow, in order to allow or block it, always takes the same four elements: source, destination, protocol with its port, and the direction of the connection (who started the exchange). A stateful firewall, like OPNsense by default, keeps only a single explicit rule per direction: the return traffic of a connection already allowed in one direction comes back automatically, with no need to write a second rule for the other direction.

What to remember

• The port names the exact service on a machine; the IP address only names the machine.
• TCP negotiates a reliable connection in three steps (SYN, SYN-ACK, ACK); UDP sends without negotiation or guarantee.
• A port scan answers in three ways: open (SYN-ACK), closed (RST), filtered (silence, the signature of a firewall).
• Any flow is described by four elements: source, destination, protocol/port, direction; a stateful firewall handles the return automatically, so there is no second rule to write.

Exam trap: confusing a closed port with a filtered port is the most common mistake. A closed port proves the machine responds; a filtered port proves nothing about what sits behind the silence, only that a filter is in place.

*Checked on September 27, 2026 against RFC 793 (TCP three-way handshake) and the Nmap reference guide (port states: open, closed, filtered).*