So I want to make my home LAN more secure, and disable direct Internet access from LAN with a firewall, but allow web traffic via proxy.

Now if I want to play on-line games, I'm supposed to open a whole lot of TCP and UDP ports to the Internet.

Some how that does not feel right.

Ok, ok, its only my home LAN, but I am interested in the principle.

If I open a range of ports to the Internet in general, is that not almost the same, as not having Inet blocked from LAN ?

A malicious software or user, could simply set traffic to go out the ports opened for the games, and the firewall would not block it.

I would think one should only open ports to specific IP addresses on the net, not the whole world.

And ports opened for instant messaging, p2p, voip etc, would also be risky.

I'm newbie, so maybe I'm wrong.

Any comments?

Depending on the types of games and the circumstances, you can often limit opening those ports to a limited number of predefined hosts or even to hosts that you initiate a connection with. For example if the online game only requires you to contact a gameserver, you can limit traffic on those ports to only the IP address of the gamesever. If you are connecting to other hosts in some type of PtP fashion, you might be able to limit incoming traffic to the ESTABLISHED,RELATED state. Again, it depends on the game and who you need to allow access.

Thank You for Your comments.

I guess opening ports that is not opened to specific hosts on the Inet, is risky.

A virus could use known ports to send data through firewalls I guess.
Say on a Microsoft system, first read the registry on proxy info, and then use that info to get out to the net.

Here a policy for authentication on proxy could stop the virus.

Or a combination of a normal firewall and "personal" firewalls on the client, that restrict what programs may use specific ports.

Well, I only have a home office, so its not that big deal for me.

As long no one gets on my firewall, and uses it for illegal stuff.

I'm maybe a bit paranoid as I'm so new with Linux, I would probably not know if a virus or hacker or a 5 year old did something eevil on the Linux FW