Config Server Firewall: What Outgoing ports need to be open for wget and apt-get install?

Question

I am just configuring CSF and I have to specify my outbound ports here. I am trying to close as many as possible leaving only what I need open, however what do I need to leave open for wget?

# Allow outgoing TCP ports
TCP_OUT = "20,21,22,25,53,80,110,113,443"

# Allow incoming UDP ports
UDP_IN = ""

# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "20,21,53,113,123

Answer 1

Outgoing firewall rules are hard, I mean really hard. Incoming are easy because as the (application|db|sys)?admin you should have a pretty good idea of who (audience) needs to talk to what (service). With outgoing rules, however, you need to,

1. Take a complete inventory of services that will be asking for data
2. For each service determine which port(s) it will be going out on
3. Find all possible hosts that your system will be contacting

Using 2 and 3 you can construct your rules. The reason this gets hard is really because of 3. Let's take OS patches as an example.

By default your package manager is almost certainly pointing at a mirror list. So you have two options,

1. Determine the IP address of every host in the mirror list and write the permit ACLs for each
2. Change your package manager to point directly at one of the hosts in the mirror list and write the permit ACL for that single host

Now do this for everything. That is why it gets complicated, and a big reason why most people don't bother. In some cases you have are required to limit outbound rules, think PCI-DSS or HIPAA depending on your auditor. However, most of the time the resource you're trying to protect isn't actually valuable enough to warrant the extra work.

That being said, it is also a fantastic exercise to go through. You will have a much stronger understanding of your system, and will have a significantly smaller attack profile to monitor.

All that being said, the wget application will most of the time be working against HTTP or HTTPS, that is TCP ports 80 or 443. It is possible to host web services on arbitrary ports so you'll need to make sure to allow the appropriate ports for whatever webserver you are pulling down data from. Also make sure to allow ESTABLISHED and RELATED connections, so that the responses will be allowed through.

Answer 2

Firebind can test any outbound UDP or TCP port to tell you whether it's blocked or not, and if so, how it's blocked (DROP, RESET, etc.)

http://www.firebind.com/clients/applet/

You can test any of the 65535 UDP or TCP ports, or even the entire range. They also have a bunch of preconfigured tests for popular apps and games.

Answer 3

The purpose of a firewall is to enforce an organizational policy regarding what network traffic to allow. We cannot tell you what firewall rules to use; the firewall rules should be designed based upon your policy. Since you haven't listed your desired policy, we can't tell you how to configure your policy.

I'm not familiar with CSF's syntax regarding firewall rules, but there is something puzzling about the code snippet you showed there. The most common policy for outbound connections is to allow all outbound connections (i.e., allow all connections initiated by an internal client). It looks like you are trying to restrict outbound connections, which is a bit unusual. Also, I hope you understand that the source port for an outbound connection (i.e., the TCP/UDP port number on the local machine) is rarely meaningful. Typically, when an outbound connection is initiated, a random source port number is used by the initiating client. This makes me wonder whether your TCP_OUT / UDP_OUT statements are going to do what you want them to do. Without knowing the CSF syntax myself, I can't comment authoritatively, but I can just raise this red flag for you to investigate further.