How to best manage multiple applications using the internet with Firewall

Question

Im not new too Linux (Ubuntu 14.x) however I must admit that I have never bothered with a Firewall until now. Im currently using Ubuntu's inbuilt firewall (UFW) with a graphical plugin (GUFW), which I have configured to revoke all incoming and outgoing connections, with the exception of allowed applications/processes for which i have created rules to manage,

e.g: Allow application 'Steam' both incoming and outgoing, port 27036.

The problem is however that some applications such as Minecraft (yes I play minecraft) for example does not appear to use a specific port for LAN connections. Additionally, other applications will undoubtedly use obscure ports for updates and communications, for which the ports are either not listed in documentation, or are not specific (as appears to be the case with Minecraft).

My current practice is to simply deactivate the firewall for short periods of time, to 'lower the drawbridge' so-to-say, whenever I am using an application which appears to use a seemingly random port. This does not strike me as a particularly efficient method, so too summarise, my questions are:

• How do I best manage a firewall with multiple network reliant applications/processes?
• Is my current method the most practical one
• And if so, is living with a firewall just plain difficult?

Answer 1

usually you trust your egress traffic and try blocking only ingress traffic. Most application do not need or use ingress. statefull firewalls are "smart" and look who initialised the connection.... for example if you are trying to connect to the steam server connection starts from your "end" and firewall will allow responses from steam server, as you "requested" it. However, if you are planning on running a mincraft server you need to know which port is used for the server and allow incoming connections on that port. So in general acceptable security posture for home use is allow all outgoing traffic, and for incoming traffic open only ports that are required when you want other people to access services you provide, otherwise block all incoming traffic.

Answer 2

Most applications should be using static ports on the servers side. In other words, one side of a connection should always be using a predictable port. Unfortunately, as you stated, living with a firewall can be a pain at first, while you build a robust policy set. You have to identify each and every service necessary and add appropriate policies to your firewall.

I don't believe the Ubuntu firewall supports it, but most modern host-based firewalls can use the application itself as a policy criteria, making things much easier.

You can identify what ports services and applications are trying to use in a few ways, but I would recommend just using a sniffer. Fire up Wireshark, start an application, see what ports and destinations it attempts to connect to, add those ports and destinations to policies, rinse and repeat for each application.