What ports do I need open ?

M$ISBS · 06-22-2010, 08:11 PM

On a desktop, single user system that is only used to browse the internet?
Do I only need port 80 open? Forgive me, I dont know much about this stuff..........
I used to use guarddog and I would disable it when I needed to chek my email, then reenable it after I checked my email. But guarddog does not work with KDE4.

win32sux · 06-22-2010, 08:19 PM

Quote:

Originally Posted by M$ISBS

On a desktop, single user system that is only used to browse the internet?
Do I only need port 80 open? Forgive me, I dont know much about this stuff..........
I used to use guarddog and I would disable it when I needed to chek my email, then reenable it after I checked my email. But guarddog does not work with KDE4.

You don't need to open any ports (you can/should have them all filtered). What you will need to allow at a minimum is outbound packets with destination ports 80/TCP (HTTP), 443/TCP (HTTPS), and 53/UDP (DNS). Example:

Code:

iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A OUTPUT -o eth0 -p TCP --dport 80  -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p TCP --dport 443 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o eth0 -p UDP --dport 53  -m state --state NEW -j ACCEPT

That said, I must ask: What are you hoping to achieve with this firewall setup? Like, why don't you just filter inbound packets while allowing all outbound ones? It's an honest question, I'm not suggesting that's the way you should go.

M$ISBS · 06-22-2010, 08:27 PM

Security, I guess. I am not sure what part of the Iptables script to place that code.
I am currently using an Iptables script I found online but it is old and I dont feel good about it. I dont know how to write them, nor do I understand iptables yet so most of what you posted is beyond me.

win32sux · 06-22-2010, 08:49 PM

Quote:

Originally Posted by M$ISBS

Security, I guess. I am not sure what part of the Iptables script to place that code.
I am currently using an Iptables script I found online but it is old and I dont feel good about it. I dont know how to write them, nor do I understand iptables yet so most of what you posted is beyond me.

Well, if you're on Slackware you could just change my example into a shell script, like:

Code:

#!/bin/sh

IPT="/usr/sbin/iptables"

$IPT -P INPUT DROP
$IPT -P OUTPUT DROP

$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT

$IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

$IPT -A OUTPUT -o eth0 -p TCP --dport 80  -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -o eth0 -p TCP --dport 443 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -o eth0 -p UDP --dport 53  -m state --state NEW -j ACCEPT

Then just save that as /etc/rc.d/rc.firewall and make it executable. That would make the commands get run automatically every startup. If you're willing to invest some time to learn the basics of iptables, I suggest this tutorial.

Although, honestly, if you're just starting out it might not be a bad idea to do only inbound filtering until you have a better grasp of things (it's up to you, of course). Such a script would be much simpler. Example:

Code:

#!/bin/sh

IPT="/usr/sbin/iptables"

$IPT -P INPUT DROP
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT

It basically says: "Send all inbound packets to DROP by default. Allow inbound packets if they are in either RELATED or ESTABLISHED state. Allow all inbound packets on the loopback interface." While doing both ingress and egress filtering is optimal, starting out with only ingress filtering is a good way IMHO to save yourself some potentially serious frustration while you're learning the basics of iptables.

M$ISBS · 06-22-2010, 09:49 PM

I am currently using this script:

http://www.ledow.org.uk/linux/rc.firewall

Its kinda old and lots of confusing code, I was thinking about toying with it but dont want to screw things up. :-

I have been searching for an Iptables book but have not made a purchase yet.

Thanks for the link.

win32sux · 06-22-2010, 11:26 PM

Quote:

Originally Posted by M$ISBS

I am currently using this script:

http://www.ledow.org.uk/linux/rc.firewall

Its kinda old and lots of confusing code, I was thinking about toying with it but dont want to screw things up. :-

Yeah, you always have the option to run a separate distro inside a virtual machine and then experiment freely, with the assurance that you won't be messing anything up in your real installation.

Quote:

I have been searching for an Iptables book but have not made a purchase yet.

Let us know if you find something nice!

Quote:

Thanks for the link.

You're welcome!

BTW, you can verify that the rc.firewall is having the desired effect by running (and perhaps also posting the output of):

Code:

iptables -nvL