Firewall pinhole

In <a href="/facts/Computer_networking/3w5RM99p">computer networking</a>, a firewall pinhole is a <a href="/facts/TCP_and_UDP_port/ygoHVKNC">port</a> that is not protected by a <a href="/facts/Firewall_(networking)/Et2RkJaU">firewall</a> to allow a particular <a href="/facts/Application_software/YQuj7Kog">application</a> to gain access to a service on a host in the network protected by the firewall.
Leaving ports open in firewall configurations exposes the protected system to potentially malicious abuse. A fully closed firewall prevents applications from accessing services on the other side of the firewall. For protection, the mechanism for opening a pinhole in the firewall should implement user validation and authorization.
For firewalls performing a <a href="/facts/Network_address_translation/nFweFNfN">network address translation</a> (NAT) function, the mapping between the external IP address, port socket and the internal <a href="/facts/IP_address/z9V22Sw9">IP address</a>, port socket is often called a pinhole.
Pinholes can be created manually or programmatically. They can be temporary, created dynamically for a specific duration such as for a dynamic connection, or permanent, such as for <a href="/facts/Signaling_(telecommunications)/6d4zgUj7">signaling</a> functions.
Firewalls sometimes automatically close pinholes after a period of time (typically a few minutes) to minimize the security exposure. Applications that require a pinhole to be kept open often need to generate artificial traffic through the pinhole in order to cause the firewall to restart its timer.

Firewall pinhole open-in-new

Firewall pinhole