Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm configuring the firewall and several times i discovered it is blocking a service or port that is needed such as dns or https..etc is it safe to do netstat -nat | grep LISTEN then whatever port there, put them in iptables in this format:

   -A INPUT -p 67 -j ACCEPT

Edit: Here is my netstat result with p option:

tcp        0      0 127.0.0.1:10001             0.0.0.0:*                   LISTEN      9521/sw-cp-                         serverd
tcp        0      0 0.0.0.0:21                  0.0.0.0:*                   LISTEN      2729/vsftpd                         
tcp        0      0 SERVERIP:53                 0.0.0.0:*                   LISTEN      1399/named                          
tcp        0      0 SERVERIP2:53                0.0.0.0:*                   LISTEN      1399/named                          
tcp        0      0 127.0.0.1:53                0.0.0.0:*                   LISTEN      1399/named                          
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1527/sshd                           
tcp        0      0 127.0.0.1:953               0.0.0.0:*                   LISTEN      1399/named                          
tcp        0      0 0.0.0.0:12443               0.0.0.0:*                   LISTEN      9521/sw-cp-                         serverd
tcp        0      0 127.0.0.1:3306              0.0.0.0:*                   LISTEN      1802/mysqld                         
tcp        0      0 :::110                      :::*                        LISTEN      1570/courie                         rtcpd
tcp        0      0 :::143                      :::*                        LISTEN      1552/courie                         rtcpd
tcp        0      0 :::80                       :::*                        LISTEN      4865/httpd                          
tcp        0      0 :::8880                     :::*                        LISTEN      9521/sw-cp-                         serverd
tcp        0      0 :::465                      :::*                        LISTEN      30122/xinet                         d
tcp        0      0 :::53                       :::*                        LISTEN      1399/named                          
tcp        0      0 :::22                       :::*                        LISTEN      1527/sshd                           
tcp        0      0 :::25                       :::*                        LISTEN      30122/xinet                         d
tcp        0      0 :::443                      :::*                        LISTEN      4865/httpd                          
tcp        0      0 :::8443                     :::*                        LISTEN      9521/sw-cp-                         serverd
tcp        0      0 :::993                      :::*                        LISTEN      1562/courie                         rtcpd
tcp        0      0 :::995                      :::*                        LISTEN      1579/courie                         rtcpd
tcp        0      0 :::106                      :::*                        LISTEN      30122/xinet   

and here is my iptables config:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 8443 -j ACCEPT
-A INPUT -p tcp --dport 53 -j ACCEPT
-A INPUT -p udp --dport 53 -j ACCEPT
-A INPUT -p 50 -j ACCEPT
-A INPUT -p 51 -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 10000 --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 631 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp -j LOG --log-prefix "Reject Traffic " --log-level 6
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited


COMMIT

it seems the firewall was blocking drweb updates. but it was also blocking dns, hence I added 53 port, also 8080 and 8443

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

If you insist on having a firewall with a default deny rule, you need to make a list of all the listening services you are running and what ports they use, and explicitly allow each of them through. One way to do this would be netstat. you might want to try adding the -p option though, so you can see what processes are associated.

Of course, open ports on a computer that isn't a router have almost no security implication unless you want to filter a particular service from a particular interface (eg. no FTP from untrusted networks) or the computer is running malware (in which case you have other problems), as traffic to ports you aren't listening on is always rejected anyway. Therefore, if you open all the ports your server is listening on, you really may as well not have the firewall.

share|improve this answer
    
I want to choose the best for a secure web server, what do you suggest based on the new edit I have added. thanks –  Dreaded semicolon May 4 '12 at 4:58
add comment

This is definitely not good practice. For every rule you add, you need to know what it is for and why you need it.

share|improve this answer
add comment

Use netstat or whatever other network scanning/monitoring tool you might have to generate a list of ports for each application, then manually go through it and make sure everything in that list looks OK.

If it's a newly configured server and not yet live on the web, it's about as clean as you're going to find. Everything should be legit, but it's always a good idea to make sure you go through the results in order to a) know what's on your server and how that stuff works b) make sure something didn't get in there that shouldn't be.

Note that there's really not a lot of protection offered by a firewall - it should never be your primary defense. Your server isn't going to randomly open a port and start sending/receiving on it - by default all ports are closed. It's only if you're tricked into installing something on the server or if there's a vulnerability in something you're already using that was not patched (perhaps it's a zero-day exploit or you didn't upgrade fast enough) that the trouble starts - in which case, your firewall won't be of much help.

For instance, if there's a vulnerability found in your FTP server software then a port that you had previously manually unblocked (say, 21) will now be an attack vector. The attacker now has the same privileges on your machine as whatever user the FTP server was running as - and your firewall is helpless to do anything about it.

If you want a truly secured web server, chroot (or better yet, BSD jail) the applications and make sure they're running as a different (never root!) user with the least permissions you can get away with. If you have something like SELinux (RedHat-based) or AppArmor (Debian-based) on your distro, use it. It's a kernel-level protection that whitelists the actions a program can take (for instance, what directories it can read/write to/from, what interrupts it can trigger, what ports it can open, etc.) and can be a huge boon when it comes to securing your server correctly.

tl;dr a firewall isn't as great as you think it is. Use that time on ACL-based configuration and jailing all your services.

share|improve this answer
    
Thanks for the answer. I'm aware it's not sufficient defense. but It's one of them and I want to configure it as best as possible for a web server. –  Dreaded semicolon May 4 '12 at 5:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.