Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not running malware on our system?
Are there any dangers in say opening up say ports 60000 to 61000 for incoming UDP connections that is significantly less safe than say just opening up a few ports?
I've just heard of mosh which advertises itself as a better way to do mobile ssh (over wifi/cell phone). Mosh uses UDP rather than TCP, so if you briefly enter a tunnel or your IP address changes (switching cell phone towers), you don't have to wait to come back from congestion control or establish a new ssh session. Basically mosh uses ssh to remotely start a mosh-server as an unprivileged user, exchanges a AES-OCB key using ssh, and then sends/receives encrypted packets (with sequence numbers) to a port in the range 60000-61000, which you should configure your firewall to open.
I'm somewhat uncomfortable with opening up ~1000 ports for incoming (UDP) connections, but can't think of a very good reason for this. If no software is listening for data on that port, it just gets ignored right? (On edit: no -- it actually directs the server to send back a ICMP (ping) destination unreachable response). I guess if I had malware running on my server, it could be waiting to listen to instructions from forged IP addresses on one of these opened ports. However, malware running on an internet connected systems already could establish connections/download information from other malware servers (though would have to know an IP address) and fetch instructions, so this doesn't make the security that much less secure.
EDIT: Interesting, just saw this other question which lead me to read about UDP_flood_attack. I guess additionally I would need to somehow disable my system from sending ping destination unreachable replies for the newly opened UDP ports.