1y ago

Can someone demystify computer Ports for me? Please? Blocking, unblocking, opening, allowing, VPNs and their effect, what ports are and what they do, step by step, when you have to interact with them?

It's the one thing when I'm configuring things that makes me wince because I know it will give me the business, and I know it shouldn't, but it does, every time. I have no real idea what I'm doing, what it is, how it works, so of course I'm blindly following instructions like a monkey at a typewriter.

Please guide me into enlightenment.

61 comments

Imagine your computer is a big block of flats and your applications are all people who live in the building.
Mail sent to the building address alone isn't going to reach the intended recipient, because the postman doesn't know what flat to post it to. So they need additional information such as 'Flat 2C'
That's the basic concept of ports. It's basically additional addressing information to allow your computer to direct internet traffic to the correct applications.
When an application is actively listening on a port, it means that they are keeping an eye out for messages addressed to them, as designated by the port number. While an application is sending or receiving messages using a given port number, that port number is considered 'open'.
Now, all sorts of applications do all sorts of things. Some are for the public to use and there are some that are useful within trusted circles, but can be abused by malicious people if anyone in the world can send messages to it. Thus, we have a firewall, which acts as a gatekeeper. A firewall can 'block' a port, denying access to a given group of people, or 'unblock' it, allowing access.
VPNs are a totally different thing. They are literally middlemen for your internet traffic. Instead of directly posting a message to somewhere and receiving a direct reply back, imagine you flew out to Italy to use a post box there and receive replies from there.
- To add to your analogy if i may, the firewall is kind of like a security guard or doorman at the building entrance. All mail has to go through him first and if something is addressed to a closed flat (port) he simply doesnt let it get delivered.
  
  Yep! The security guard is also given a bunch of rules to follow such as "don't let anyone outside of our neighbourhood (aka your local network) contact door 22", which will also determine whether messages get delivered or not
- I love your analogy for ports, but I'm not sure about the VPN one.
  If you imagine network traffic as mail going through the postal system, then a VPN is like a private mail tunnel between two locations, that nobody else can enter or look into. Mail sent via the tunnel is private and nobody else can read it. The person at the other end of the tunnel can either open the mail themselves (ie a VPN from your laptop to your home server to access it when you're away), or forward the mail somewhere else (ie if you're routing Internet-bound traffic through it) and nobody will know it came from you originally.
  
  I'm not sure that's a completely accurate analogy either. When you're using a VPN people can still see that you are sending traffic through your tunnel, they just can't tell what it is that you're sending. It's like looking through frosted glass; there's definitely something moving in there but you can't tell what.
  I suppose the best way to describe it is you send a locked box to a trusted friend; everyone handling it can see the box but can't tell what's inside. Inside the box is a letter, your friend posts it so it looks like it came from them. Your friend then gets a reply, puts it in a locked box, and send it back to you. Nobody between you and your friend can snoop on your mail but anyone between your friend and the final destination can.
- To expand on port forwarding, consider your router to be the lobby to your apartment building, but you get to choose which rooms are reachable by an outside visitor.
  
  Port forwarding would be like if all the apartments were listed 1-[x] inside the building, but 1A-1Z, 2A-2Z and so on to outsiders. Someone sends a message to
  <address>
  , apartment 2Y, and the lobby knows that actually goes to apartment 51.
- To expand on that analogy... certain services need entry into the building and then from there, they get distributed throughout the building.
  Water comes in on the water line.
  Electricity comes in on the electric wire.
  Internet may come in on coaxial or fiber.
  Gas comes in on the natural gas pipeline.
  Your computer has ports to deal with basic tasks. These are called "well known port numbers".
  https://www.geeksforgeeks.org/50-common-ports-you-should-know/
  So while, in theory, you COULD get email in on a non-email port, that wouldn't be expected and would be like feeding water through a natural gas line.
  
  Just reading that URL and I'm sorry (to the author of that article), but there's no way there are 50 ports "you should know". 443, 80, 22, and that's about it. Maybe whatever the SMPT port is just for interest's sake, but that's very rarely going to be important practical knowledge. And there are some ports outside the well-known port range that might be handy. Your VPN's port, your DB's port. But even then, you're not getting anywhere near 50.
- Excellent description.

A “port” is just a number that gets assigned to network messages to differentiate targets within the same IP address.
One program is “listening on port 1”, which means it has told the operating system “anything labeled port 1, send it to me”.
It’s sort of like saying “attention: Joe” versus “attention: Sue” on an address. Same address, same building, but that “attention” line means to put it on Joe’s desk inside the building.
Except instead of “attention: Joe”, it’s just “attention: 22”. A numerical code that represents a “mailbox” inside the computer.
- That is The Good Answer.
  Another, very similar way of thinking about it is that It's effectively like an apartment or office number. A post office typically ignores it, but if told to, they would forward a specific apartment number at a specific address to a new address and apartment number.
- To take this further, if the office mailroom is the router, opening a port is like telling them "we just hired Jeff, so accept mail with ATTN Jeff" and closing a port is like "we just fired Sam, burn all mail addressed to Sam".

IP is like an address to a big skyscraper where a company operates. You are the delivery man and must go to 201.154.76.19 and deliver something. When you get at the reception, you tell them you have a package to deliver to Mrs HTTPS, at room (port) 443. Since Mrs HTTPS is well known and has cleared your entry before, you're allowed to enter this room and only this room.
If you were to get at the same address and try to access other rooms you would either get refused because they are closed, or if open, someone would specifically need to be in the room so you can deliver something
Malicious actors that wanted access to the building could try to disguise their deliveries and enter the building, that's why the default policy of most firewalls is "reject" and you specifically need to open a port and have a program listening to it if you want incoming connections.

Just think of your computer or server as a huge building with thousands of doors. Most are closed, but you purposely open a few to allow traffic in and/or out of. Those that are open are only open for a specific purpose and will only lead in or out of a specific place in the building.
- Not OP but wondered the same thing for ages. Thanks for your concise reply. Am I right in thinking ports aren't actually physical things but entirely logical instead ? I always assumed they were physical "pipes" because of the name but in the light of replies here it feels like I assumed wrong
  
  They're defined by the software that listens for incoming connections. For example, a web server will (by default) open a listening port on port 80, as that's what is defined in the http standard. If said server supports https (which most of them do) it will also open a listening socket on 443.
  It's easy to reconfigure a webserver (or any other server) to listen on any other port instead, provided that it's not already claimed by a different server software. The only caveat is that any clients that want to connect will have to specify the correct port. For example, if the webserver is instead running on port 1234, you'd type http://example.com:1234/ in the address field.
  Ports are identified by their number which is in the range of 1 through 65535. The first 1024 ports are "official", which can often be observed by the fact that most of the fundamental protocols that makes the internet function is in this range (http, https, ftp, ssh, dns, smtp, pop3, imap just to name a few). And on linux systems, opening a listening socket on a port below 1024 requires root privileges.
  It's worth noting that no port number is "better" than any other. Port 2 will work just as well as 22222. It's just a way for a server to know which server software should receive the incoming packets.
  A bit beyond what you're asking, but I consider it a natural furtherance thereof: you can talk to a webserver manually by using telnet. It's easy, I just don't remember the syntax in my head, but it's an easy question for google.

When you have a bunch of computers networked, each of them is assigned a unique number, so when other computers send data on the wire, they can say who it is meant for (imagine each blurb of data starting out like: "yo, I'm sending these next 500 bytes for computer 0A123FBC32, here they come").
Now the right computer will listen, but it doesn't know what program the data is for - is it a chunk of a file your browser is downloading? Or the email your email app wants to display? Or perhaps a join request from your buddy's computer for the Minecraft game you're hosting?
So in addition to the unique number of the target computer, the data also specifies a "port number", which tells the computer which of its running programs the data is meant for (programs ask the computer's operating system: "if any network data arrives on port XY, give it to me"). Some ports have become standards - for example, a program that serves web pages to other computers would typically ask the operating system that any data arriving on the computer that indicates port numbers 80 and 443 should be given to it, and when a web browser wants to fetch a web page, it will send a request to the computer serving the page, defaulting to port 80 o 443.
If you dig deeper, you'll find that there are even more unique numbers involved and routers/firewalls let data through not only by port number but also by distinguishing between data that is the initial request to another computer's port number and data that is an answer to an earlier seen request -- and more.
- This is a great explanation, pretty much what I would have said
- This is the first time I understand ports in networking. Thank you!

If IP addresses are for finding the specific computer on a network you're wanting to talk to, Ports are for finding the specific application you want to talk to on that computer. So kinda like a phone extension. When an application "opens" a port, they're just telling the OS "hey, if any packets come in on this port, send the data my way, I'll know what to do with it".
A firewall is a special program the OS uses to control access to its ports. It says what programs are allowed to access what ports, effectively controlling the ability for all apps to access the network.
The only other thing to know is that the first 1024 port values are usually heavily controlled by the OS because there are specific protocols that are traditionally used on those specific ports, so you usually don't want just any application claiming one of those ports willy-nilly.
Oh, and you may have had to deal with "port forwarding" on your router. This is because, if some computer outside your network sends a packet to your router targeting a specific port number, the router doesn't know which computer it should go to. So by default, it just ignores it (which is usually the safest thing to do). Port forwarding tells your router, "if any packets come in on this port, send them to the computer at this IP, they'll know what to do with it."
- This is really good, I just want to clarify one thing:
  there are specific protocols that are traditionally used on those specific ports
  Protocols are not 'used on ports', it's actually the other way around: TCP and UDP are both protocols operating on top of IP, each with its own set of ports to help direct traffic, exactly as you explained.
  There are other protocols, like ICMP or GRE, that exist quite happily without knowing anything about ports (ICMP has types and codes, GRE doesn't).
  Edit: I suppose it is actually a bit ambiguous because we also refer to applications (HTTPS, telnet) as protocols. I'm not sure if there is a standard way to differentiate when discussing other than just saying transport layer protocol / application layer protocol.
  
  Yeah, didn't want to dig deep in the interest of brevity, but I didn't want to say that specific applications use those ports, even though I already said that ports in general are for applications. You can use whatever ftp, ssh, or http server you want as long as they "speak" the expected protocol.

Thats a lot of information to ask for so ill try to be very basic. A port is like a window with a guy on the other side. if you speak the same language as the guy you can have a conversation.
There are 65535 windows available. the open have guys available for conversations, the closed ones dont.
When you open a port on your computer you should have a program that "listens" at that port so that others can use it to have a conversation.
A vpn takes all of the conversations your computer wants to have and sends them to a port on a server and the program listening to that conversation sends your requests to their intended destination and then sends you the result. Its like using a middleman to have a conversation.

Let's say you want to talk to your friend. You have several protocols, Phone, Mail, Email, SMS, or maybe something stranger, like smoke signals or memes. Each protocol needs a different port.
Your friend doesn't answer phone calls or check VMs. The 'port' for phone calls is blocked. Nothing gets in through here.
Your friend only accepts email from certain addresses, like protonmail. This port is filtered. Only known things get in through here.
Your friend accepts any texts if they begin with the secret pass phrase. This port is open and filtered. Few unknown things get in through here.
Your friend accepts all postage. This port is open. Anything can get in through here. HTTP or HTTPS, your browser.
The VPN is sort of like an opaque tunnel you run from your house alongside public roads to some place you feel safe exiting, And then the usual steps in communicating. All of the communication has to go through the exit point back to the house.
If this kind of thing interests you, have a basic book for free. https://open.umn.edu/opentextbooks/textbooks/353

Without invoking any analogies, a port is just a number. When an application on your computer sends or receives data, there is a port number associated with it. A server-side application listens for data with a particular port number, and a client side application needs to send data with the same port number to communicate with the right server application. The operating system uses the port number to route incoming data to the right application, and it ensures that only one application at a time can use any given port number.
Some port numbers are assigned to specific protocols (by IANA, I believe), like 80 for HTTP and 443 for HTTPS, so when you see a URL, the default port is usually implied by the protocol, but it can always be specified. For instance, https://google.com is equivalent to https://google.com:443. For more obscure protocols without assigned port numbers, you'll usually see the port number in a URL, and this tends to happen in the same scenarios where you don't have a domain name, so you'll also see an IP address in a URL. It also happens when you need to run more than one of the same kind of server on a single machine. For example, when developing an HTTP server app, it's customary to use port 8080 or 8888 to distinguish it from the "official" server app on the same machine using port 80, so your development server app will have a URL that looks like http://192.168.0.1:8080.
Typically ports 0-1023 are reserved by the operating system for programs set up by an administrator, and ports starting at 1024 up to a maximum of 65535 are available to any user, so they're perfect for, say, a Jellyfin server or an app you're developing. If someone gives you a URL with a port number, especially if it's above 1023, make sure you trust the owner of the URL, because it can be a giveaway that someone is doing something shady.

The short answer is, when your computer sends a message over the network, the IP address specifies which computer should receive the message, and the port specifies which program should receive the message.

Maybe think of it like one of those big walls of post office mailboxes......behind the wall is your computer and an app might be waiting for a message at box 22 or box 45678. You could close all the boxes and nothing could get in, or you could open one or all of them and allow people to deliver messages to them.
If you connect your computer directly to the internet, anyone who knows your IP address could say 'deliver message X to port 22 at ip address
<your ip address>
and the program watching that box would get the message.
If you put a router in the mix, and multiple computers, the router has the same block of boxes, but if someone sends a message to one of the boxes it just sets there. If you set up 'forwarding', sending a message to your ip address gets the message to the router, but if you forward box 22 from your router to a specific computer on your network, then the router takes a message at box 22 on itself and 'forwards' it to box 22 on whatever computer you specific (using internal ip addresses).
You could map box 22 on your router to any other box on your computer....like port 22 coming into your router might get sent to port 155 on your computer...this is useful if you don't want external people just exploring and lazily breaking into your computer using known vulnerabilities. Lots of ports are 'common', so an ftp hack on port 22 is easy, and might be 'slightly' harder if you tell your computer to actually look for ftp traffic on port 3333 or something.
- The one statement "using internal IP addresses" has clarified something to where I'm actually excited to try working on a long-standing problem.
  But how come I'll get instructions from a program that I have to allow ip "bla.bl.b.blah:80" when that number isn't my IP? Then I go on my router and do it and the program doesn't work/port isn't open? Those kind of problems kill me.
  
  This is a really old message, but if you're still having the same question i could try to answer, but that kind of message is pretty context dependant. For that specific one, it sounds like your program is trying to access something outside your network,, like they have a website they need to access to check for updates or something.

Think of the Internet as being able to send opened letters with a destination address and return address. Anyone that handles the letter to help deliver it can see what it says, who's sending it, and where it's going.
A VPN is like asking a company to help you transmit the letter with more privacy. The VPN creates a secret code between you and the VPN, so that only you two understand what is in the letter. Then, the VPN communicates with whomever while not sharing your identity so that no one knows who you are unless you specifically tell them in the letter.
Say you want to know what the symptoms you're experiencing after a sexual encounter are, but you're embarrassed and don't want anyone to suspect anything in case it's nothing. You tell your VPN you want to send a letter to the medical info center. The VPN tells you to use a code that was created automatically so that no one knows what it means besides you and their code machine, and was sent to you earlier when you signed up for their service or at a regular update. "Use code 5 we sent you last week." You write the letter and address in code 5, then address it in normal language to the VPN, sending it via the mail system. The VPN machine translates the code to normal language but changes the return address to its own address. The medical info center receives a letter saying that the VPN wants to know the info you requested, so they respond. The VPN receives the info, translates it back to code 5, and sends the info to you.
As far as everyone in the mail system is concerned, you sent and received info from the VPN, but only you know what it was because the mail system couldn't understand it, and the VPN handled it through an automated machine. The medical mail system and medical info center then knows what the letter said, but thinks the VPN requested that info, so they don't know it was you. Since the VPN handles tons of mail, no one knows who is requesting what specific info through the VPN.
Note: This assumes the VPN doesn't keep logs. Some VPNs might actually track what you send, so they could keep track of your messages. That's why people that value privacy recommend to use VPNs that don't keep logs.

- Just to clarify, nothing about ports requires wifi to be involved at all. It doesn't need to be a wifi router, a network doesn't have to be connected via wifi.
  
  Funfact: doesn't even require ethernet. Any link that involves an IP will do.

A port is basically what it sounds like, a hole in your network to allow traffic to get to your pc
When you forward a port you send all traffic trying to get into that port to the computer you configure it to forward to. I believe forwarding and opening are synonymous, I'm sure someone will correct me if I'm wrong
There are two protocols for transmitting data you can open/close individually, TCP and UDP. Depends on the application, some want one, some want the other, some can use either or some want both
Opening ports allows anyone with your IP address to get at your computer, which means they have a chance to exploit any vulnerabilities there might be in your os, networking stack, software etc, so generally it's a good idea not to leave them open unless absolutely necessary
Personally I use tailscale to get around having to open ports, makes it as if they're all on the same network
- Port forwarding is related to router forwarding all the traffic it gets on specific port to your computer. Port opening is just enabling to communicate via a new port on your computer.
  Both can be done irrespective of each other and sometimes they do happens simultaneously. The router could forward the traffic to a new port that you opened on your computer. But they are not synonymous with each other.

The port is used by the destination computer to decide what program should process the request.
Any program on your computer that needs to be open to being contacted by another computer over the network needs to be assigned to a port. When the remote computer wants to contact that program, the IP address is used by intermediate networking computers to forward the message, and the port is used by your computer to pass the message to the right program. Blocking a port will prevent the program assigned to it from being contacted by other computers.
Some ports are traditionally assigned to some common programs. When you go to a website via http in a browser, it uses port 80 if you don’t specify. If you use https, it uses port 443. SSH uses port 22 by default. You can host an ssh server or http website on a different port, those are just the common conventions. If an http website is hosted on a port other than 80, the user will need to specify the port number in the browser as part of the url.
VPNs are usually not so much about ports, more about IP addresses. When your computer wants to contact another computer, it normally sends the request to the router, and that router forwards that request either to another computer on LAN or to the ISP, and that ISP forwards the request and so on… based on the IP address. If you are using a VPN, that VPN will override certain IP addresses. When a message would be sent to one of those IP addresses, instead it gets packaged and sent to the IP address specified in the VPN config, and the computer on the other side of the VPN decides where to send the message from there. The router sends the packages message to the VPN computer, but doesn’t get to know what the IP of the packaged message is (by packaged I mean encrypted, and with some metadata).
Where VPNs and Ports end up being relevant is probably in relation to port forwarding. Normally your computer can make requests to the internet, but can’t be contacted by the internet. This is because your entire LAN shares a public (WAN) IP address, and the router is the device that receives all messages to that IP address. Normally the router discards such incoming messages, but if you set up port forwarding, the router will forward messages for a certain port to a certain computer on the LAN.
A VPN can allow your computer to receive incoming requests without opening a port on the router. When a request meeting requirements specified in the VPN config is received by the computer on one side of the VPN, it will be forwarded to the computer on the other side of the VPN. For a public VPN (the kind you would pay for that are typically advertised as a privacy tool or a way to get around Netflix geofencing), you can sometimes configure port forwarding, meaning any request sent to that port on the VPN’s server will get forwarded to your computer connecting to the VPN (typically to the same port, so what happens to that request is up to you to configure a program to be assigned to that port).
The other way a VPN can be used for that kind of contact is when it maps all requests to any port on a set of IP addresses. This is typically how office VPNs are configured, as it lets a remote user access things on the office network as if that user was in the office.
Note that a VPN is itself a pair of programs communicating with each other like any other program, so typically setting up a VPN requires one of the computers to be exposed to the internet (or at least have ports set up for that). For a public paid VPN the VPN’s servers will be exposed to the internet, and for a corporate VPN the corporate servers will be closed, such that the client doesn’t have to.
Some common VPN software (e.g. WireGuard) is free and open source and can be configured in a lot of different ways! These two common use cases are just the most common ways to configure VPNs, but if you have some creative use case, there’s a lot you could do with it.

The top cat uses ports to sort messages based on application.
Think pigeon holes, applications usually use protocols which are assigned a number by convention. The application gets it's message out of it's assigned ports instead of having to sort through all the messages.

"porte" in French means a door.
Imagine each port is a door, all neatly aligned... some of them can be opened and lead to something... (a service)
- And when you go through the door, you must know the language to speak (the protocol) or you may be told to leave or ignored.
  
  yeah you need to know the password or secret handshake (like a protocol handshake) to be let in! :)

https://en.m.wikipedia.org/wiki/Port_(computer_networking)
- I mean, you're not wrong. Just a bit of an asshole.

All these answers read like they're written for comp sci students rather than a general audience. Let me give an ELI5 (more like ELI12) a shot.
Ports are just numbers. They aren't physical pathways or doors or windows or anything like that. A better analogy is a street address, like an apartment number. Your IP address identifies your computer (apartment building), and the port identifies the program on the computer (the apartment). When a program needs to talk to the internet, which is very similar to sending a letter, it hands a packet/letter to your computer and your computer assigns the program a port number. It then puts that number on the return address of the letter so that the recipient knows where to send the response. The computer remembers that port number is associated with that program, so when it gets an incoming letter with that number, it gives it to the program. After the program is done talking to the internet, the computer frees the port up to be used by another program.
Ports are "closed" when there is no program associated with them. Any incoming letters are ignored because they have nowhere to go.
Ports are "open" when they're associated with a program. This happens automatically when programs send outgoing letters, or you can manually open (or "forward") ports by telling your computer/router what the port should be associated with and that it shouldn't use the port for something else.
ELI5 over.
The internet is networks on top of networks on top of networks, so your computer will have an IP and assign a port number, then your router will remember that and change the address on the letter to its own IP with a different port number, then that process repeats a few more times until eventually it reaches its destination. You don't have to deal much with your computer's internal network, but occasionally you have to deal with your router's by opening/forwarding a port because it has a NAT that has to deal with all of the devices on your network. Forwarding the port just tells your router to always send incoming letters with that port number to a specific device.

A port is a convenience wrapper for the application space. That's really it. The networking stack delivers messages to the host, and then the kernel uses ports to distribute messages from there. Otherwise every application would need to parse out every network (or local) payload to determine if it is relevant or not. This obviously ends up with a lot of duplicate processing, thus port routing instead.

It would really help to know what concepts you are already familiar with and feel like you understand. Edit: it would also be helpful to know what you are trying to do that has you working with ports or using a VPN. There are countless situations where ports and VPNs are involved. /Edit Lacking that, I'm going to cover a lot of basic concepts. I'm assuming typical/common situations, as always it can always be different and more complicated. Wall of text incoming.
Typical basic networks are a collection of devices that are able to communicate with each other through some medium like a wired network or WiFi. Each device In a network will have an IP address (a set of four numbers between 1 and 254 divided by periods for example: 192.168.1.100). For one device to send a message to another device, it addresses the message to the device using its IP Address. This is like sending a letter in the mail - you need to mark the letter with the street address or it won't be delivered.
Now sticking with this analogy, if I wanted to send you a letter and you lived in a hotel or apartment complex without a dedicated address just for you, I need to make sure to address the letter not just to your building but also to you specifically. This is where ports come in. If I want to join your Minecraft server, I need to be able to reach your computer specifically and I also need to make sure my Minecraft game is talking to your Minecraft server and not your web browser or something. Software listens for specific ports. So to join a Minecraft server hosted on your computer with the address 192.168.1.100 I'd need to also specify the port so that the Minecraft server software know my messages are for it specifically.
That's the ELI5 version.
Stepping up the complexity now. In most cases, joining someone's Minecraft server is more complicated because I'm on my home network, and my router is connected to the internet, and through the internet I connect to your router and then from your router I need to connect to your computer. The way this works is that each of our routers are on two different networks - our home network and the Internet.
Most home networks will look very similar. There are ranges of addresses that are reserved for local (non internet) network devices, such as my example IP address - 192.168.1.100. It is possible that each of our networks (and countless other home networks) have a device with this IP address so I can't just send a message to 192.168.1.100 and have it get to your networks 192.168.1.100 address. Fortunately, routers act as middlemen and coordinate communication between devices inside our network and devices on the internet. Think of the router as a fancy doorman outside the hotel or apartment who knows what room all of those living there are staying.
Unfortunately, it is often the case that my computer will not know the IP address of your computer within your network. You can work around this by using port forwarding. I write "Minecraft" on the letter and you instruct your doorman that any letter with "Minecraft" written on it should be delivered to your Minecraft server. In reality, you'd forward any traffic from the internet with a specific port number directly to your Minecraft server computer. The computer running the server is already "listening" for traffic on that port and will take it from there.
Now for more complicated stuff. Technically, ports are rather arbitrary. Some ports are standardized. As someone else had mentioned, port 80 is the standard for HTTP and 443 is standard for HTTPS (encrypted). However, nothing is stopping you from hosting a webserver on a server using a different port, like port 12345. Your web browser will assume port 80 and the webserver will ignore your web browser until you tell your browser to use port 12345. It is also possible for multiple service or pieces of software to have the same port which causes problems. I have a server on my home network and multiple services that display a web page (port 80 or 443). They can't all use the same port so I have to work around this by either using different ports or assigning each a different IP address.
So what does "opening" a port mean? Well, as you might imagine there are many pieces of software and many services running on devices in your home network. As a security precaution, many routers will block or ignore any traffic on the internet that tries to talk to it in a way it is not expecting. You don't want randos trying to connect to your computer through the internet and your router.
Unblocking or opening a port could be something like forwarding a port to a device on your network. Technically, this would involve finding a "Port Forwarding" setting on your router. Here, you would indicate any traffic with port 25565 (the default Minecraft server port) should be directed to your server at address 192.168.1.100. Now your doorman will always deliver every letter with "Minecraft" written on it to your Minecraft server. Be aware that even if you aren't the server software, every letter like that will continue to be directed to your server. If there is a security flaw in Minecraft, this could technically be something someone could exploit.
Similar to your router, Windows (the operating system) will also block/ignore traffic that it isn't expecting as a security precaution. Opening a port might mean creating a rule in your firewall setting to let traffic from certain ports into your computer. If Windows is ignoring any letters it doesn't recognize, my Minecraft letters still won't reach your Minecraft server even if it is clearly addressed to it. Windows may also be blocking traffic from leaving your computer if it does not have a firewall rule telling it otherwise so its possible the server got my letter, but Windows blocked the reply so I'm left hanging.
A VPN is a Virtual Private Network. This term can mean a few different scenarios but what they all have in common is that it creates a hole into your network, bypassing the router (maybe both routers). It is sometimes called a tunnel, which is a pretty good metaphor. Basically, you are running a virtual network cable through the internet from one computer or network to another. Through this virtual network, devices will be able to see and interact with each other as if they were on the same network.
Real life example. I manage a few servers where I work. If I need to log into those servers from home I cannot do this. It would be extremely dangerous to just let anyone on the internet have access to the server's login screen. So instead, I use a VPN. Now my home computer is virtually connected to my work's internal network - as if I'd brought my personal laptop into work and plugged it into the network jack next to my workstation in my office. I can use the same software I'd use at work to log into my servers without having those servers directly exposed to the internet. I am limited by my home internet speeds but it is otherwise almost identical.
Similarly, we could install VPN software on our two computers and I could then join your Minecraft server directly, bypassing your router, as if we were both on your home network.
Like I said, there are quite a few ways to do this and I've heard many of the ways referred to as either a VPN or a tunnel. More context could get you a better answer.
Generally, opening ports is a security risk. This is especially true when opening more common ports or ports that get a lot of use. More common, standard ports will be more likely to get attacked and ports that get a lot of use will be more likely to be targets of exploits. It really depends on your scenario. Imagine that, if someone wanted, they could likely figure out what port you've opened and what is listening for that port on your home network. They might try to brute force a password or take advantage of the software's security flaws.
Forwarding a randomly chosen port so a friend can join your Minecraft server? Not so risky. Opening port 22 so you can log into your home computer while you are away from home? Much riskier. Using an atypical port for remote access is still risky as, like I said, you have to assume that if someone really wanted to, they could figure out that remote access is running on port 17426 or whatever random number you may have chosen.
- There are ranges of addresses that are reserved for local (non internet) network devices, such as my example IP address - 192.168.1.100
  I just wanted to add that in some cases, the devices on your home network will have a public IP. For example, IPv6 uses a different public IP for each device on the network. You still need a router in that case, since your system still needs to know how to reach another network such as the internet.

https://www.youtube.com/watch?v=3kfO61Mensg
- Here is an alternative Piped link(s):
  https://www.piped.video/watch?v=3kfO61Mensg
  Piped is a privacy-respecting open-source alternative frontend to YouTube.
  I'm open-source; check me out at GitHub.

VPN: you give your mail to a dude who puts it in a plain suitcase and goes with it to the VPN company's HQ. Nobody knows whose mail he's got or where it's headed. When that dude gets to the VPN company's office he gives that envelope to another dude who carries it to the destination. If someone's peeping they can only see the dude going from your place to the VPN place or from the VPN place to the destination, not from your place to the destination.

If an IP address is like a building address for a mall, ports are like suite numbers of the different businesses inside the mall.
There are a few types of ports, but mostly you deal with tcp and udp. Tcp ports create a connection, udp is connectionless.

You have servers that provide some kind of resource or service, and clients that use those resources or services (will just say resource from now on).
Servers provide that resource using a port so clients will come ask for it using that port.
Sometimes servers can do multiple things, so they will provide multiple resources...maybe a web server hosting a web page is also an email server that can receive and send email too. They do those things using different ports to distinguish the kind of request it's getting.
On the client side, clients use source ports to distinguish which app asked for a resource. Think of your browser having 20 tabs open, each has it's own source port so your computer never gets confused which page goes to which tab.
I'm skipping a lot of things (ports flipping for replies, well known, etc), but that's the basics.

61 comments