Preamble: So, before I actually ask the question, I'd like to point out that I'm somewhat apprehensive about posting this because even as I'm typing this out it it feels like I'm asking someone to just tell me the switch config I need, which isn't the case. I already have the main switch configuration finalised and ready to go back to the client, but they've asked me to verify the /entire/ config they're going to actually apply to the switches, not just the application-specific stuff, hence the question below. Anyway, now that's over, on to the actual question.
I've been developing an application for a client which will run on a bunch of load-balanced AWS servers running Debian 7.5 which will only be accessible on port 80 for the application itself from all addresses, and port 22 for SSH from just our office and the office of the client's outsourced AWS management team.
The client's security policy is needfully restrictive as the servers will contain sensitive business data, so the network configuration needs to be locked down for incoming and outgoing connections from all servers as much as possible. I've already outlined the requirements for this part and it's been agreed between myself and the AWS team. However, they have asked me to verify the final configuration they are going to apply and this includes the following lines:
Source Destination Protocol Ports Service Action Description
0.0.0.0/0 192.168.0.0/16 TCP 1024-65535 Ephemeral Ports Allow Allows inbound return traffic from the Internet
192.168.0.0/16 0.0.0.0/0 TCP 32768-65535 Ephemeral Ports Allow Allows outbound responses to clients on the Internet (for example, serving web pages to people visiting the web servers in the subnet)
Unfortunately, the network layer is the one aspect of the OSI model about which I know very little. I was vaguely aware that some services use ephemeral ports for the actual worker connections after the initial request to the service's well-known port has been established, but I'm not sure which services actually need these ports to be open on the public interfaces of servers in order for those servers to function correctly. The comment implies that 32768-65535 are required for web servers to function, but I've had authoritative responses from them in the past which have later turned out to be wrong, so I want to confirm this assertion.
Do either of nginx or sshd require the ephemeral ports to be open in order for them to perform their functions correctly, or does all activity always happen only on the ports they have been configured to use (eg, 80 and 443, and 22 respectively)? Would closing the ephemeral ports to traffic prevent services like apt from functioning correctly (which I believe usually uses HTTP on port 80 to interact with its sources)?
Additionally, they have added the following two lines regarding DNS queries to the configuration:
Source Destination Protocol Ports Service Action Description
0.0.0.0/0 192.168.0.0/16 TCP/UDP 53 DNS Allow Allows inbound DNS query from anywhere
192.168.0.0/16 0.0.0.0/0 TCP/UDP 53 DNS Allow Allows outbound DNS queries to anywhere
Now, we're not running DNS daemons on these servers, so I'm pretty sure we can discount the first line entirely, but would closing 53 to either in- or outbound traffic prevent the servers from resolving host names correctly? I have to admit I've never actually looked into how DNS actually works that closely as I've never needed to. :s Suppose now's a good time to start!
But yeah, the tl;dr summary:
Will closing ports 1024-65535 to all traffic, both inbound and outbound, prevent any of nginx, sshd, DNS queries, or any core operating system utilities from functioning correctly on Debian servers?
dig
and its ilk, or services like monitoring software, etc?