Should I block UDP datagrams to dynamic/private ports?

I have been using Kerio 2.1.5 on my p.c., which is connected to the internet via a 4-port router. A couple of other p.c.s are also connected to the router.

The system has been working fine for a year and I've been using BlitzenZeus's rules (slightly modified for my own situation).

I've just changed my p.c. and reloaded all the software that I had on my old one. My OS is still XP Pro SP2, as before.

My new p.c. can't seem to access the internet unless I unblock local ports 49152 - 65535. svchost.exe is now sending UDP datagrams from these ports to the router port 53.

I never had this problem on my now discarded p.c. which is about six years old.

Is it ok to leave these ports unblocked? Could it be the modern hardware spec of my new p.c. that's causing the difference?

 

Hi,
Local ports 49152 - 65535 must be unblock to svchost.exe.Because DNS service need local ports 49152 - 65535 and 1024-5000.



regards
cqpreson

 

The default dynamic port range for TCP/IP has changed.
http://support.microsoft.com/kb/929851

Panagiotis

 

This is for Vista, isn't it?

I'm using XP Pro SP2. Never had the same issue on my last XP Pro SP2 machine, (which last had a Windows update in June 2008.)

Unless the port range has been changed by a recent Microsoft Security update for XP... Has it?

 

Yes, it is for Vista.

On my xp SP3 I do not see local connections from ports 49152 - 65535.

Panagiotis

 

Be interested to know if that's still the same after a "Windows Update"...

Anyway, my main question is: Is it safe to unblock ports in the 49152 - 65535 range to svchost.exe for both TCP/UDP in and out?

I've read that some malware can be disguised as svchost

 

It is still the same.

It is safe to unblock those ports.
As long as svchost.exe resides in the directory "\WINDOWS\system32" of your system partition you should not worry.

Panagiotis

 

Thanks, Panagiotis!

 

Glad I could help.

Panagiotis