1

I'm using Ubuntu 18.04 with iptables.

I want that attackers would see a consistent state when trying to map my ports. I want all my ports to appear as filtered (i.e., drop everything). However, some applications need a specific open port when I'm using them.

I would like that for this specific port, the firewall will drop everything if there is no application listening on that port (instead of replying with reject). And allow everything if there is an application that is listening.

Is it possible?

1 Answer 1

2

While I'm not aware of a single/simple iptables rule to have it open/close a port based on a service actually listening on that port, you can achieve what you need by changing the default iptables policy to DROP and allow only the ports you need.

For example, say you have sshd listening on port 22 and apache2 on port 80 (don't do this if connected via ssh!)

# Start with empty tables
iptables -F
iptables -X

# Change INPUT policy to DROP
iptables -P INPUT DROP

# Make sure the machine itself can connect to the internet
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Maybe allow ICMP's echo/reply (i.e. ping)
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT

# Add ports for which there are services listening
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

This way, for every port but 22 and 80, iptables drops the packets.

If you need a new port open, just add ("append") a new rule

iptables -A INPUT -p tcp --dport NN -j ACCEPT

If you don't need a port anymore, delete the relevant rule

iptables -D INPUT -p tcp --dport 80 -j ACCEPT

If you want a sort of automatic allowing/denying based on services (it looks so from your question), you can always have a basic iptables ruleset and then modify your services' scripts to append (-A) the relevant rule on startup and delete it (-D) on stop.

3
  • So the answer my question is no? Oct 25, 2018 at 13:25
  • @LiranFunaro it's yes. While you cannot use a "static" iptable rule to automagically open/close a port, you can dynamically insert and delete a rule on a per-need basis while keeping a default DROP policy for all ports so they appear as "filtered" on port scanning and such. Oct 25, 2018 at 13:50
  • "While you cannot use a "static" iptable rule to automatically open/close a port": That is the answer I was looking for. Thanks. I suggest inserting it to your answer. Oct 25, 2018 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.