[SOLVED] Which ports to involve with firewall?

[909mjolnir]

if I use the common familiar Linux firewall stuff, how do I know which ports to edit?
This is the main stumbling block I have so my systems end up insecure and the hackers in this area are fierce.

Please help, if you can.

I'm in between distros for now, so I have nothing in front of me yet.

SOLVED: See posts by 'TheFu' in this thread.
Thanks 'TheFu' ! Awesome response.

[currentshaft]

What do you mean by "edit"? Blocking ports is typically not necessary unless you're planning on vising untrusted networks, and even then the default Ubuntu installation does not really expose anything.

[909mjolnir]

@currentshaft :

Yeah, I've heard that before, years ago. But it just isn't true anymore. There's tone of articles since about 2019 talking about Linux's need for better security defaults and implementation. I can't find hardy any tutorials yet.

[currentshaft]

@currentshaft :

Yeah, I've heard that before, years ago. But it just isn't true anymore. There's tone of articles since about 2019 talking about Linux's need for better security defaults and implementation. I can't find hardy any tutorials yet.

It is true. The burden is on you to provide objective evidence to the contrary. A vague first-hand recollection of some 5 year old "articles" does not suffice for the same. The lack of "hardy any tutorials [sic]" is proof you don't need to worry about this problem.

If you want to care about security, that's great, but the network firewall is not something to concern yourself with, unless you travel to sketchy places, and even then the default set of services on Ubuntu presents no risk.

[#&thj^%]

This looks interesting: https://safing.io/

It will take a small learning curve.

[Rubi1200]

if I use the common familiar Linux firewall stuff

What does that mean?

Are you using a GUI frontend?

There are many threads on the forum that discuss ports and basic rules about what to block (or not).

Would be worthwhile searching for them I think.

[gezzer2]

i use GUFW which i enable then set to 'public' it does most of the basic 'firewall stuff' that is needed ..

[TheFu]

For high security, block everything coming in and everything going out. Then open outbound ports in the firewall that are needed for the specific things you do.

For example, do you want to connect to a mail server for reading and replying to email? That's usually port 465/tcp (SMTPs) and 993/tcp (IMAPS).

Do you want to access remote websites? Those use post 80/tcp and 443/tcp, typically. Streaming videos may hop to a different port and may use UDP instead of TCP.
You'll likely want DNS to be allowed. Depending on which type of DNS you use, that can be on port 53/udp or 53/tcp or if you use DNS-over-HTTPS, that would use 443/tcp.

Want to print to a network printer? CUPS is usually on port 631/tcp.

The major ports used for different network services are listed in the /etc/services file. May want to review that.

CIFS, NFS, ssh, are a few other things commonly used.

What most people do is to block all incoming connections, then allow all outbound connections on their workstations. Then they would add specific rules for the inbound network services only if needed. You can allow those for any systems on the same subnet or for specific IPs on the subnet. If you do specific IPs, then you'll need to have a well-managed network.
For one of my LAN servers, here are all the inbound firewall rules

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
4949/tcp                   ALLOW       172.22.22.4               
111                        ALLOW       172.22.22.0/24            
2049                       ALLOW       172.22.22.0/24            
22/tcp                     ALLOW       172.22.22.0/24            
8096                       ALLOW       172.22.22.0/24            
13025                      ALLOW       172.22.22.0/24            
5353                       ALLOW       172.22.22.0/24            
3142                       ALLOW       172.22.22.0/24             # apt-cacher-ng
1900                       ALLOW       172.22.22.0/24             # DLNA
6600                       ALLOW       172.22.22.0/24            
123/udp                    ALLOW       172.22.22.0/24            
7359/udp                   ALLOW       172.22.22.0/24             # Jellyfin Discovery UDP
8000                       ALLOW       172.22.22.0/24             # Jellyfin TV Icons
8181                       ALLOW       172.22.22.0/24

Each was carefully selected for specific reasons. Another servers has these rules:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
631                        ALLOW       172.22.22.0/24            # Printing
22                         ALLOW       172.22.22.0/24            # ssh
4949/tcp                   ALLOW       172.22.22.4
5353/udp                   ALLOW       Anywhere                  # zeroconf/avahi/mdns
2049                       ALLOW       172.22.22.0/24            # NFS
13025                      ALLOW       172.22.22.0/24            # NFS
111                        ALLOW       172.22.22.0/24            # ident

My desktop has these rules:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere                  
4949/tcp                   ALLOW       172.22.22.4

I figured seeing real examples would be helpful. These are only the rules controlled by UFW. I have some other rules that get added dynamically when using VPN software. My VPN server has a bunch of rules to allow connections between different subnets.

[909mjolnir]

@TheFu

My god, man, you have the answer.
I don't know how anybody ever learns this stuff.
It's not exactly common knowledge.

Thanks so much.
I will see if I can give it a go eventually.
I don't want to mess up my internet.

But thanks! Seems like the answer.

For high security, block everything coming in and everything going out. Then open outbound ports in the firewall that are needed for the specific things you do.

For example, do you want to connect to a mail server for reading and replying to email? That's usually port 465/tcp (SMTPs) and 993/tcp (IMAPS).

Do you want to access remote websites? Those use post 80/tcp and 443/tcp, typically. Streaming videos may hop to a different port and may use UDP instead of TCP.
You'll likely want DNS to be allowed. Depending on which type of DNS you use, that can be on port 53/udp or 53/tcp or if you use DNS-over-HTTPS, that would use 443/tcp.

Want to print to a network printer? CUPS is usually on port 631/tcp.

The major ports used for different network services are listed in the /etc/services file. May want to review that.

CIFS, NFS, ssh, are a few other things commonly used.

What most people do is to block all incoming connections, then allow all outbound connections on their workstations. Then they would add specific rules for the inbound network services only if needed. You can allow those for any systems on the same subnet or for specific IPs on the subnet. If you do specific IPs, then you'll need to have a well-managed network.
For one of my LAN servers, here are all the inbound firewall rules

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
4949/tcp                   ALLOW       172.22.22.4               
111                        ALLOW       172.22.22.0/24            
2049                       ALLOW       172.22.22.0/24            
22/tcp                     ALLOW       172.22.22.0/24            
8096                       ALLOW       172.22.22.0/24            
13025                      ALLOW       172.22.22.0/24            
5353                       ALLOW       172.22.22.0/24            
3142                       ALLOW       172.22.22.0/24             # apt-cacher-ng
1900                       ALLOW       172.22.22.0/24             # DLNA
6600                       ALLOW       172.22.22.0/24            
123/udp                    ALLOW       172.22.22.0/24            
7359/udp                   ALLOW       172.22.22.0/24             # Jellyfin Discovery UDP
8000                       ALLOW       172.22.22.0/24             # Jellyfin TV Icons
8181                       ALLOW       172.22.22.0/24

Each was carefully selected for specific reasons. Another servers has these rules:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
631                        ALLOW       172.22.22.0/24            # Printing
22                         ALLOW       172.22.22.0/24            # ssh
4949/tcp                   ALLOW       172.22.22.4
5353/udp                   ALLOW       Anywhere                  # zeroconf/avahi/mdns
2049                       ALLOW       172.22.22.0/24            # NFS
13025                      ALLOW       172.22.22.0/24            # NFS
111                        ALLOW       172.22.22.0/24            # ident

My desktop has these rules:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere                  
4949/tcp                   ALLOW       172.22.22.4

I figured seeing real examples would be helpful. These are only the rules controlled by UFW. I have some other rules that get added dynamically when using VPN software. My VPN server has a bunch of rules to allow connections between different subnets.

[currentshaft]

With all due respect, a traditional firewall as you've described is effectively 100% security theater which is not going to prevent Real Bad Things(tm) from happening.

Local malware will just use TCP port 443, the same port which is allowed for web browsing.

If anything, these sort of firewalls actually worsen security because they provide a false sense of protection, by creating a proverbial moat which appears impenetrable but is in reality a weak and meaningless boundary.

If you want security, do not install and expose unnecessary services, and those which are exposed should use mutual authentication based on strong crypto. This is also known as "zero trust".