Are there advantages in closing a port where no services are running?
What do I gain in terminating a connection at iptables level instead of what does it next (I guess OS).
3 Answers
I would go the other route and block all ports. Open them as you need the service. Doing this has the advantage that if you unknowingly start a service, your machine is not vulnerable.
answered Aug 4, 2013 at 9:40
-
I think if this got expanded on it will help noobs more, but great answer Aug 5, 2013 at 10:24
-
good policy, but to many admins block everything without understanding on how internet works (e.g. all icmp) which change how things work and makes life hard (e.g. rfc1435, can't use ping to diagnose problem, etc.). Also read an article in usenix mag (very old edition) how a superadmin didn't have open policy (i.e. no firewall) because his server were very well maintained. Too bad only a few are as good as him.– imel96Aug 8, 2013 at 17:12
The advantage is that you can safely use the port. Many programs will use a pseudo-random port, or can be programmed to use a port. In either case, if you don't close the port, they may be accessible from other hosts.
As Francois noted, a closed policy is safer. Begin with all ports closed and open those you need in the appropriate direction. It is common, to require services for which you don't have or want a local server. DNS is usually required, but you don't need to allow incoming requests. Several ICMP types (3,4,11) are required for proper network functionality, but others may be safely blocked. It is common to enable echo (8) selectively, which should enable incoming echo-reply (0) messages if related packets are accepted.
Most firewall builders such as Shorewall, will allow the these ports in their example or default rule sets.
As the other answers have stated, it's generally a closed policy is safer than only locking down certain services.
For example, say you install a rouge service that starts listening on a random port, and phones home. The black hat guy who wrote the software could potentially perform unsolicited actions through their service.
