TL; DR
This article will dive into this error message I accidentally found in Firefox when I tried to access a local server with certain port, which is quite interesting. It is also not well documented, so I decided to do some little documentation.
localhost:6000
I was trying to debug one of my projects imgp and I set the port to 6000, then I encountered the error “This address is restricted”. This is the first time I saw this error, and I initially thought the application is broken until I realized it’s just I cannot use this port:
This address is restricted
This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection.
I found it interesting, but I needed to debug my applications first, so I changed the port and only posted it on Mastodon.
VU#476267
After I posted on Mastodon, James replied and pointed out this is Mozilla’s port banning years ago (https://www-archive.mozilla.org/projects/netlib/portbanning) and 6000 is basically the first port X11 Server will assigned to, thus the ban. Looking through the post, I found that it is initially reported to be a fix for a vulnerability VU#476267 that reported on August 16, 2001.
This vulnerability, in simple word, allows attackers to craft malicious HTML to trick a victim’s programs that is capable of rendering HTML (such as browsers) into sending data to services the attacker cannot directly access (like X11 Server), which completely bypasses normal protections like firewalls.
In order to solve this vulnerability, they decided to ban a series of ports related to system services. It is reported as bug 83401 and gets fixed in Firefox 0.9.1 on June 28, 2004. Yep, this is before Firefox getting an official release.
…wait, why this is on the Mozilla Archive?
Documentation…?
I quickly realized there is no (modern) documentation. There is people asking like this with solutions to how to remove the port restriction, but besides that, there is no official documentation.
The original documentation have a outdated list of ports. With community documentation from mozillazine, they both provide a link that where the detailed ports should look at, but heavythe link is dead (https://lxr.mozilla.org/seamonkey/source/netwerk/base/src/nsIOService.cpp#89). So, I decided to write about it.
Documentation…
Well, I decided to write this mini documentation for people if they needed (Definitely don’t need it).
Current banned ports1
Here’s the table with properly capitalized service names:
| Port | Service |
|---|---|
| 1 | TCPMUX |
| 7 | Echo |
| 9 | Discard |
| 11 | SYSTAT |
| 13 | Daytime |
| 15 | NETSTAT |
| 17 | QOTD |
| 19 | CHARGEN |
| 20 | FTP Data |
| 21 | FTP Control |
| 22 | SSH |
| 23 | Telnet |
| 25 | SMTP |
| 37 | Time |
| 42 | Name |
| 43 | NICNAME |
| 53 | Domain |
| 69 | TFTP |
| 77 | PRIV-RJS |
| 79 | Finger |
| 87 | TTYLINK |
| 95 | SUPDUP |
| 101 | HOSTNAME |
| 102 | ISO-TSAP |
| 103 | GPPITNP |
| 104 | ACR-NEMA |
| 109 | POP2 |
| 110 | POP3 |
| 111 | SunRPC |
| 113 | AUTH |
| 115 | SFTP |
| 117 | UUCP-PATH |
| 119 | NNTP |
| 123 | NTP |
| 135 | LOC-SRV / EPMAP |
| 137 | NetBIOS |
| 139 | NetBIOS |
| 143 | IMAP2 |
| 161 | SNMP |
| 179 | BGP |
| 389 | LDAP |
| 427 | AFP (alternate) |
| 465 | SMTP (alternate) |
| 512 | Print / Exec |
| 513 | Login |
| 514 | Shell |
| 515 | Printer |
| 526 | Tempo |
| 530 | Courier |
| 531 | Chat |
| 532 | Netnews |
| 540 | UUCP |
| 548 | AFP |
| 554 | RTSP |
| 556 | RemoteFS |
| 563 | NNTP+SSL |
| 587 | SMTP (outgoing) |
| 601 | Syslog-conn |
| 636 | LDAP+SSL |
| 989 | FTPS-Data |
| 990 | FTPS |
| 993 | IMAP+SSL |
| 995 | POP3+SSL |
| 1719 | H323GATESTAT |
| 1720 | H323HOSTCALL |
| 1723 | PPTP |
| 2049 | NFS |
| 3659 | Apple-SASL |
| 4045 | LOCKD |
| 4190 | Sieve |
| 5060 | SIP |
| 5061 | SIPS |
| 6000 | X11 |
| 6566 | SANE-PORT |
| 6665 | IRC (alternate) |
| 6666 | IRC (alternate) |
| 6667 | IRC (default) |
| 6668 | IRC (alternate) |
| 6669 | IRC (alternate) |
| 6679 | OSAUT |
| 6697 | IRC+TLS |
| 10080 | Amanda |
Overwrite the ban
- In a new tab, type
about:configin the address bar and press Enter/Return. ClickAccept Risk and Continue; - In the search box, type
network.security.ports.banned.override, and check if the option exists (there is no add button but a edit button at the end).- if option exists: click the edit button on the preference line;
- If option doesn’t exist: on the preference line of
network.security.ports.banned.override, selectStringand press the add button.
- In the input field, enter the port number separate by comma without spaces, for example,
1,6000. Press the save button (the check) to save.
No need to restart browser, it takes effect immediately.
One thought, head (almost) empty
Please add a official documentation Mozilla :(
