IP is like an address to a big skyscraper where a company operates. You are the delivery man and must go to 201.154.76.19 and deliver something. When you get at the reception, you tell them you have a package to deliver to Mrs HTTPS, at room (port) 443. Since Mrs HTTPS is well known and has cleared your entry before, you’re allowed to enter this room and only this room.

If you were to get at the same address and try to access other rooms you would either get refused because they are closed, or if open, someone would specifically need to be in the room so you can deliver something

Malicious actors that wanted access to the building could try to disguise their deliveries and enter the building, that’s why the default policy of most firewalls is “reject” and you specifically need to open a port and have a program listening to it if you want incoming connections.

When you have a bunch of computers networked, each of them is assigned a unique number, so when other computers send data on the wire, they can say who it is meant for (imagine each blurb of data starting out like: “yo, I’m sending these next 500 bytes for computer 0A123FBC32, here they come”).

Now the right computer will listen, but it doesn’t know what program the data is for - is it a chunk of a file your browser is downloading? Or the email your email app wants to display? Or perhaps a join request from your buddy’s computer for the Minecraft game you’re hosting?

So in addition to the unique number of the target computer, the data also specifies a “port number”, which tells the computer which of its running programs the data is meant for (programs ask the computer’s operating system: “if any network data arrives on port XY, give it to me”). Some ports have become standards - for example, a program that serves web pages to other computers would typically ask the operating system that any data arriving on the computer that indicates port numbers 80 and 443 should be given to it, and when a web browser wants to fetch a web page, it will send a request to the computer serving the page, defaulting to port 80 o 443.

If you dig deeper, you’ll find that there are even more unique numbers involved and routers/firewalls let data through not only by port number but also by distinguishing between data that is the initial request to another computer’s port number and data that is an answer to an earlier seen request – and more.

Maybe think of it like one of those big walls of post office mailboxes…behind the wall is your computer and an app might be waiting for a message at box 22 or box 45678. You could close all the boxes and nothing could get in, or you could open one or all of them and allow people to deliver messages to them.

If you connect your computer directly to the internet, anyone who knows your IP address could say 'deliver message X to port 22 at ip address <your ip address> and the program watching that box would get the message.

If you put a router in the mix, and multiple computers, the router has the same block of boxes, but if someone sends a message to one of the boxes it just sets there. If you set up ‘forwarding’, sending a message to your ip address gets the message to the router, but if you forward box 22 from your router to a specific computer on your network, then the router takes a message at box 22 on itself and ‘forwards’ it to box 22 on whatever computer you specific (using internal ip addresses).

You could map box 22 on your router to any other box on your computer…like port 22 coming into your router might get sent to port 155 on your computer…this is useful if you don’t want external people just exploring and lazily breaking into your computer using known vulnerabilities. Lots of ports are ‘common’, so an ftp hack on port 22 is easy, and might be ‘slightly’ harder if you tell your computer to actually look for ftp traffic on port 3333 or something.

If IP addresses are for finding the specific computer on a network you’re wanting to talk to, Ports are for finding the specific application you want to talk to on that computer. So kinda like a phone extension. When an application “opens” a port, they’re just telling the OS “hey, if any packets come in on this port, send the data my way, I’ll know what to do with it”.

A firewall is a special program the OS uses to control access to its ports. It says what programs are allowed to access what ports, effectively controlling the ability for all apps to access the network.

The only other thing to know is that the first 1024 port values are usually heavily controlled by the OS because there are specific protocols that are traditionally used on those specific ports, so you usually don’t want just any application claiming one of those ports willy-nilly.

Oh, and you may have had to deal with “port forwarding” on your router. This is because, if some computer outside your network sends a packet to your router targeting a specific port number, the router doesn’t know which computer it should go to. So by default, it just ignores it (which is usually the safest thing to do). Port forwarding tells your router, “if any packets come in on this port, send them to the computer at this IP, they’ll know what to do with it.”

A port is basically what it sounds like, a hole in your network to allow traffic to get to your pc

When you forward a port you send all traffic trying to get into that port to the computer you configure it to forward to. I believe forwarding and opening are synonymous, I’m sure someone will correct me if I’m wrong

There are two protocols for transmitting data you can open/close individually, TCP and UDP. Depends on the application, some want one, some want the other, some can use either or some want both

Opening ports allows anyone with your IP address to get at your computer, which means they have a chance to exploit any vulnerabilities there might be in your os, networking stack, software etc, so generally it’s a good idea not to leave them open unless absolutely necessary

Personally I use tailscale to get around having to open ports, makes it as if they’re all on the same network

“porte” in French means a door.

Imagine each port is a door, all neatly aligned… some of them can be opened and lead to something… (a service)

https://www.youtube.com/watch?v=3kfO61Mensg

Let’s say you want to talk to your friend. You have several protocols, Phone, Mail, Email, SMS, or maybe something stranger, like smoke signals or memes. Each protocol needs a different port.

Your friend doesn’t answer phone calls or check VMs. The ‘port’ for phone calls is blocked. Nothing gets in through here.

Your friend only accepts email from certain addresses, like protonmail. This port is filtered. Only known things get in through here.

Your friend accepts any texts if they begin with the secret pass phrase. This port is open and filtered. Few unknown things get in through here.

Your friend accepts all postage. This port is open. Anything can get in through here. HTTP or HTTPS, your browser.

The VPN is sort of like an opaque tunnel you run from your house alongside public roads to some place you feel safe exiting, And then the usual steps in communicating. All of the communication has to go through the exit point back to the house.

If this kind of thing interests you, have a basic book for free. https://open.umn.edu/opentextbooks/textbooks/353

The top cat uses ports to sort messages based on application.

Think pigeon holes, applications usually use protocols which are assigned a number by convention. The application gets it’s message out of it’s assigned ports instead of having to sort through all the messages.

A port is a convenience wrapper for the application space. That’s really it. The networking stack delivers messages to the host, and then the kernel uses ports to distribute messages from there. Otherwise every application would need to parse out every network (or local) payload to determine if it is relevant or not. This obviously ends up with a lot of duplicate processing, thus port routing instead.

https://en.m.wikipedia.org/wiki/Port_(computer_networking)

Thats a lot of information to ask for so ill try to be very basic. A port is like a window with a guy on the other side. if you speak the same language as the guy you can have a conversation.

There are 65535 windows available. the open have guys available for conversations, the closed ones dont.

When you open a port on your computer you should have a program that “listens” at that port so that others can use it to have a conversation.

A vpn takes all of the conversations your computer wants to have and sends them to a port on a server and the program listening to that conversation sends your requests to their intended destination and then sends you the result. Its like using a middleman to have a conversation.

Just think of your computer or server as a huge building with thousands of doors. Most are closed, but you purposely open a few to allow traffic in and/or out of. Those that are open are only open for a specific purpose and will only lead in or out of a specific place in the building.

It would really help to know what concepts you are already familiar with and feel like you understand. Lacking that, I’m going to cover a lot of basic concepts. I’m assuming typical/common situations, as always it can always be different and more complicated. Wall of text incoming.

Typical basic networks are a collection of devices that are able to communicate with each other through some medium like a wired network or WiFi. Each device In a network will have an IP address (a set of four numbers between 1 and 254 divided by periods for example: 192.168.1.100). For one device to send a message to another device, it addresses the message to the device using its IP Address. This is like sending a letter in the mail - you need to mark the letter with the street address or it won’t be delivered.

Now sticking with this analogy, if I wanted to send you a letter and you lived in a hotel or apartment complex without a dedicated address just for you, I need to make sure to address the letter not just to your building but also to you specifically. This is where ports come in. If I want to join your Minecraft server, I need to be able to reach your computer specifically and I also need to make sure my Minecraft game is talking to your Minecraft server and not your web browser or something. Software listens for specific ports. So to join a Minecraft server hosted on your computer with the address 192.168.1.100 I’d need to also specify the port so that the Minecraft server software know my messages are for it specifically.

That’s the ELI5 version.

Stepping up the complexity now. In most cases, joining someone’s Minecraft server is more complicated because I’m on my home network, and my router is connected to the internet, and through the internet I connect to your router and then from the router I need to connect to your computer. The way this works is that each of our routers are on two different networks - our home network and the Internet.

Most home networks will look very similar. There are ranges of addresses that are reserved for local (non internet) network devices, such as my example IP address - 192.168.1.100. It is possible that each of our networks have a device with this IP address. Fortunately, routers act as middlemen and coordinate communication between devices inside our network and devices on the internet. Think of the router as a fancy doorman outside the hotel or apartment.

Unfortunately, it is often the case that my computer will not know the IP address of your computer within your network. You can work around this by using port forwarding. I write “Minecraft” on the letter and you instruct your doorman that any letter with “Minecraft” written on it should be delivered to your Minecraft server. In reality, you’d forward any traffic from the internet with a specific port number directly to your Minecraft server computer. The computer running the server is already “listening” for traffic on that port and will take it from there.

Now for more complicated stuff. Technically, ports are rather arbitrary. Some ports are standardized. As someone else had mentioned, port 80 is the standard for HTTP and 443 is standard for HTTPS (encrypted). However, nothing is stopping you from hosting a webserver on a server using a different port, like port 12345. Your web browser will assume port 80 and the webserver will ignore your web browser until you tell your browser to use port 12345. It is also possible for multiple service or pieces of software to have the same port which causes problems. I have a server on my home network and multiple services that display a web page (port 80 or 443). They can’t all use the same port so I have to work around this by either using different ports or assigning each a different IP address.

So what does “opening” a port mean? Well, as you might imagine there are many pieces of software and many services running on devices in your home network. As a security precaution, many routers will block or ignore any traffic on the internet that tries to talk to it in a way it is not expecting. You don’t want randos trying to connect to your computer through the internet and your router.

Unblocking or opening a port could be something like forwarding a port to a device on your network. Now your doorman will always deliver every letter with “Minecraft” written on it to your Minecraft server. If there is a security flaw in Minecraft, this could technically be something someone could exploit.

Similar to your router, Windows (the operating system) will also block/ignore traffic that it isn’t expecting as a security precaution. Opening a port might mean creating a rule in your firewall setting to let traffic from certain ports into your computer. If Windows is ignoring any letters it doesn’t recognize, my Minecraft letters still won’t reach your Minecraft server even if it is clearly addressed to it. Windows may also be blocking traffic from leaving your computer if it does not have a firewall rule telling it otherwise so its possible the server got my letter, but Windows blocked the reply so I’m left hanging.

A VPN is a Virtual Private Network. This term can mean a few different scenarios but what they all have in common is that it creates a hole into your network, bypassing the router (maybe both routers). It is sometimes called a tunnel, which is a pretty good metaphor. Basically, you are running a virtual network cable through the internet from one computer or network to another. Through this virtual network, devices will be able to see and interact with each other as if they were on the same network.

Real life example. I manage a few servers where I work. If I need to log into those servers from home I cannot do this. It would be extremely dangerous to just let anyone on the internet have access to the server’s login screen. So instead, I use a VPN. Now my home computer is virtually connected to my work’s internal network - as if I’d brought my personal laptop into work and plugged it into the network jack next to my workstation in my office. I can use the same software I’d use at work to log into my servers without having those servers directly exposed to the internet. I am limited by my home internet speeds but it is otherwise almost identical.

Similarly, we could install VPN software on our two computers and I could then join your Minecraft server directly, bypassing your router, as if we were both on your home network.

Like I said, there are quite a few ways to do this and I’ve heard many of the ways referred to as either a VPN or a tunnel. More context could get you a better answer.

Generally, opening ports is a security risk. This is especially true when opening more common ports or ports that get a lot of use. More common, standard ports will be more likely to get attacked and ports that get a lot of use will be more likely to be targets of exploits. It really depends on your scenario. Imagine that, if someone wanted, they could likely figure out what port you’ve opened and what is listening for that port on your home network. They might try to brute force a password or take advantage of the software’s security flaws.

Forwarding a randomly chosen port so a friend can join your Minecraft server? Not so risky. Opening port 22 so you can log into your home computer while you are away from home? Much riskier.

Ports are just ways for applications to communicate data amongst themselves or other computers, networks, internet etc. They’re represented by a number, and there are well known standards for certain ports, like HTTP web traffic is most commonly over port 80, HTTPS encrypted web traffic is usually over port 443, etc. The reason for ports is it allows the ability to lock down a computer or networked device from external communication (like computers on the same network, or the internet) and only allow certain applications to have outbound or inbound traffic and data communication, thus increasing security from malware, hackers, unwanted snooping, etc.

For example, by leaving the web browsing ports open, but blocking all other ports, you can communicate over the internet, but not share all of your images from your “Pictures” or “Documents” folders on your device, thus keeping you safe.

Every computing device, phone, tablet, etc has ports that can be opened and closed, even the Operating System running on your device, or even your WiFi router. When you’re reading articles about opening or blocking ports, its usually talking about how to open ports on your WiFi router so in incoming or outgoing application connection trying to communicate from/to internet and your computer can establish a connection through your wifi routers and not be blocked. Or how to open those same ports on your Operating System, so the connection can be established from the internet, though your WiFi router, through your OS, to the application running on your computer. Ports are usually blocked by default, and you need to open them, though the standard ones (like web traffic, port 80, 443 are usually defaulted to open for convenience sake)

A VPN, is a Virtual Private Network, it allows you to create a network of computers or devices that aren’t actually on the same network, for example, we could make a VPN between your computer and mine, and they would be able to see each other, transfer files between themselves, etc, just like we were in the same home, on the same WiFi. The VPN’s are established over a port, and use a port to communicate, so you’d most likely need to open the port on your WiFi router and computer to establish the connection.

Most of remote connections for business, are done through a VPN. When you work from home, but are able to see the internal resources from your company, a lot of times its achieved with a VPN.

The word “Private” in Virtual Private Network, means that that the connection is encrypted and people can’t see the traffic going between the devices in this ‘virtual network’ traveling over the internet. People can also use this to their advantage and use a VPN in other ways, such as hiding traffic from illegal behavior, such as pirating movies and music, from their internet provider. Their computer is connected to a random server connected by the VPN, they go to the pirate bay, request to download a movie, the request comes from the other computer connected in the VPN, and is sent to their computer, with their internet provider being none-the-wiser.