About the Port Range Parser
Port lists arrive in inconsistent forms — comma-separated, hyphenated ranges, mixed, sometimes with duplicates or overlaps — and every firewall, security group, and network policy syntax expects something slightly different. This parser normalises the input and expands or collapses it into the form you need.
The value is mostly in catching the mistakes. Overlapping ranges, a range written backwards, and a value outside the valid 1 to 65535 window are all easy to miss in a long list and all produce rules that are silently wrong rather than rejected.
It is also worth checking a list against the ephemeral port range before deploying it. Blocking or reallocating ports the operating system hands out to outbound connections produces intermittent failures that look like anything but a firewall rule.
Frequently asked questions
What is the valid range for a port number?
1 to 65535, because the field is 16 bits. Port 0 is reserved and, when passed to bind, means let the operating system choose a free port — which is useful in code and meaningless in a firewall rule. Ports below 1024 are the well-known range and traditionally require elevated privilege to bind on Unix systems.
What is the ephemeral port range and why does it matter?
It is the block the kernel allocates from for the source port of outbound connections — commonly 32768 to 60999 on Linux. It matters because assigning a service to a port inside that range risks an intermittent conflict with an outbound connection, and because a host making very many simultaneous outbound connections can exhaust the range entirely, which presents as connection failures under load.
Is there a limit on how many ports a firewall rule can list?
Yes, and it varies. AWS security groups count each rule against a quota per group and per network interface, so a long list of individual ports consumes the budget quickly. Expressing the same set as contiguous ranges uses far fewer entries. Some appliances also degrade in performance well before their documented maximum.
Should I open a range or list individual ports?
List individual ports when the set is genuinely small and fixed, because it documents intent and grants nothing extra. Use a range when the ports are contiguous and numerous, both for rule-count limits and readability. What to avoid is a wide range opened because two ports at its edges were needed.
Do TCP and UDP port numbers share a namespace?
No, they are independent. TCP 53 and UDP 53 are different endpoints and can be handled by different processes. This matters for DNS, which uses UDP for ordinary queries and TCP for large responses and zone transfers — a rule that allows only UDP 53 works until a response exceeds the datagram limit and the resolver retries over TCP.
Need this managed for you, not just automated?
We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.