Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Are there advantages in closing a port where no services are running?

What do I gain in terminating a connection at iptables level instead of what does it next (I guess OS).

share|improve this question

3 Answers 3

up vote 15 down vote accepted

I would go the other route and block all ports. Open them as you need the service. Doing this has the advantage that if you unknowingly start a service, your machine is not vulnerable.

share|improve this answer
    
I think if this got expanded on it will help noobs more, but great answer –  WojonsTech Aug 5 '13 at 10:24
    
good policy, but to many admins block everything without understanding on how internet works (e.g. all icmp) which change how things work and makes life hard (e.g. rfc1435, can't use ping to diagnose problem, etc.). Also read an article in usenix mag (very old edition) how a superadmin didn't have open policy (i.e. no firewall) because his server were very well maintained. Too bad only a few are as good as him. –  imel96 Aug 8 '13 at 17:12

The advantage is that you can safely use the port. Many programs will use a pseudo-random port, or can be programmed to use a port. In either case, if you don't close the port, they may be accessible from other hosts.

As Francois noted, a closed policy is safer. Begin with all ports closed and open those you need in the appropriate direction. It is common, to require services for which you don't have or want a local server. DNS is usually required, but you don't need to allow incoming requests. Several ICMP types (3,4,11) are required for proper network functionality, but others may be safely blocked. It is common to enable echo (8) selectively, which should enable incoming echo-reply (0) messages if related packets are accepted.

Most firewall builders such as Shorewall, will allow the these ports in their example or default rule sets.

share|improve this answer

As the other answers have stated, it's generally a closed policy is safer than only locking down certain services.

For example, say you install a rouge service that starts listening on a random port, and phones home. The black hat guy who wrote the software could potentially perform unsolicited actions through their service.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.