Traffic from the customer

The following protocol and port combinations are blocked:

• TCP/0 destination (normally reserved)
• UDP/19 source and destination (chargen)
• TCP/25 destination (outbound SMTP, typically spam)
• TCP/445 destination (MS-DS and SMB)
• UDP/520 destination (RIP, malicious route updates to customer equipment)
• UDP/1900 destination (uPnP services, access to customer equipment if misconfigured)

Traffic to the customer 

The following protocol and port combinations are blocked:

• TCP/0 destination (normally reserved)
• UDP/19 source and destination (chargen)
• TCP/135 destination (NetBios-related)
• TCP/139 destination (NetBios-related)
• TCP/445 destination (MS-DS and SMB)
• UDP/520 destination (RIP, malicious route updates to customer equipment)
• UDP/1900 destination (SSDP)
• TCP/3479 destination (TWRPC)
• TCP/7547 destination (CWMP)

ICMP traffic

The following rules apply for ICMP traffic (e.g. ping, traceroute, MTR):

• No ICMP traffic originating from the customer is blocked
• ICMP traffic to the customer is blocked (except for types 0, 3, 4, 11)

Port policy for business customers may differ from the above.

References

• SMB Security Best Practices (Department of Homeland Security)