Are there advantages in closing a port where no services are running?
What do I gain in terminating a connection at iptables level instead of what does it next (I guess OS).
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
The advantage is that you can safely use the port. Many programs will use a pseudo-random port, or can be programmed to use a port. In either case, if you don't close the port, they may be accessible from other hosts.
As Francois noted, a closed policy is safer. Begin with all ports closed and open those you need in the appropriate direction. It is common, to require services for which you don't have or want a local server. DNS is usually required, but you don't need to allow incoming requests. Several ICMP types (3,4,11) are required for proper network functionality, but others may be safely blocked. It is common to enable
echo (8) selectively, which should enable incoming
echo-reply (0) messages if
related packets are accepted.
Most firewall builders such as Shorewall, will allow the these ports in their example or default rule sets.
As the other answers have stated, it's generally a closed policy is safer than only locking down certain services.
For example, say you install a rouge service that starts listening on a random port, and phones home. The black hat guy who wrote the software could potentially perform unsolicited actions through their service.