2

When I deploy new linux servers - I start off with a bare bones Ubuntu Server OS and install only the services that are needed.

  • SSH
  • webserver - port 80

These services have iptables rules setup to ACCEPT connections to them - so the firewall provides no benefit in that regard.

The server gets frequent requests to all sorts of ports - ranging from 22 to 56,000 - but no services are listening or responding to those ports.

If the server had no firewall the server's network stack will respond with a RST reset packet - otherwise the server would provide no services to the attacker on that port.

With a correctly configured firewall , iptables will silently drop these packets to the floor.

if the attacker scanned all ports they would eventually find the open ports and therefore establish that the server is connected to the internet and get a mapping of the ports accepting connections.

So is the core benefit of a firewall on a server, to basically slow down the speed at which an attacker gets a mapping of open ports?
If not, what actual purpose does a firewall have on a server?

  • iptables does far more than allow incoming connections - it can inspect for valid packets, block IPs, etc. – schroeder Sep 24 '15 at 4:11
  • So does that mean - if you were not using any of those advanced features, inspecting and manipulating packets, blocking IPs, etc - there is no reason to have a firewall? – the_velour_fog Sep 24 '15 at 4:14
1

In my setups the purpose is to prevent accidentially opening ports to the public which could allow random attackers to do bad things. For example, you could test configuration of an email service which comes as an open relay out of the box. If there is no firewall and you forget to turn it off you are spamming probably after a few hours already.

Any kind of software can open a port, sometimes you dont know. So thats why I like to have a global firewall where I explicitly can allow certain minimum ports to be accessible.

Start with only having SSH enabled (and direct root logins disabled of course), and then only open new ports if the service to be exposed is fully configured and hardened.

In the end, as you say, there might be only 4 or 5 ports opened in the firewall, all the other connections will be refused.

Note also that a firewall can be configured to deliver RST packets instead of silent drops (with REJECT policy). This is more compliant to RFCs of course, and still does not expose any risks. If you want to slow the scanner, then of course, use DROP policy.

  • nice one, yes that is basically the conclusion I came to myself - e.g . whenever I run $ netstat -plunt to see what services Im running on machine, there are usually a service or two thats running that I had totally forgotten I had setup. And of course disabling password authentication for SSH is one of the first step I take when setting up a server, which again supports the whats the point of a basic firewall theory? (since its the SSH encrypted link and public/private authentication thats providing security in that case - not firewall) – the_velour_fog Sep 30 '15 at 9:53
  • Thanks. You can use password auth IMHO as long as you cannot directly use root user. I disable root logins in the sshd config, and then use a normal maintenance user, and then do su - inside this user in case I need root privileges. – flohack Sep 30 '15 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.