When I deploy new linux servers - I start off with a bare bones Ubuntu Server OS and install only the services that are needed.
- webserver - port 80
These services have iptables rules setup to ACCEPT connections to them - so the firewall provides no benefit in that regard.
The server gets frequent requests to all sorts of ports - ranging from 22 to 56,000 - but no services are listening or responding to those ports.
If the server had no firewall the server's network stack will respond with a
RST reset packet - otherwise the server would provide no services to the attacker on that port.
With a correctly configured firewall , iptables will silently drop these packets to the floor.
if the attacker scanned all ports they would eventually find the open ports and therefore establish that the server is connected to the internet and get a mapping of the ports accepting connections.
So is the core benefit of a firewall on a server, to basically slow down the speed at which an attacker gets a mapping of open ports?
If not, what actual purpose does a firewall have on a server?