From 04a58708145724e0928fc301422ca828c9f8f26e Mon Sep 17 00:00:00 2001
From: hdegroote <75906619+HDegroote@users.noreply.github.com>
Date: Mon, 23 Mar 2026 16:13:35 +0100
Subject: [PATCH] Always firewall invalid ports

---
 lib/server.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/server.js b/lib/server.js
index 5d14f61e..363e3b70 100644
--- a/lib/server.js
+++ b/lib/server.js
@@ -280,6 +280,8 @@ module.exports = class Server extends EventEmitter {
       hs.rawStream = this.dht.createRawStream({
         framed: true,
         firewall(socket, port, host) {
+          if (!(port > 0 && port < 65536)) return true
+
           // Check if the traffic originated from the socket on which we're expecting relay traffic. If so,
           // we haven't hole punched yet and the other side is just sending us traffic through the relay.
           if (hs.relaySocket && isRelay(hs.relaySocket, socket, port, host)) {