0

Scenario:

My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following,

[arif@arif:~]$ sudo iptables -I INPUT -p tcp --destination-port 5938 -m mac ! --mac-source xx:xx:xx:xx:xx:xx -j DROP
[arif@arif:~]$ sudo iptables -I INPUT -p udp --destination-port 5938 -m mac ! --mac-source xx:xx:xx:xx:xx:xx -j DROP

According to this article Teamviewer first try to connect through port 5938, then 443 then 80. But blocking these port (luckily I am not using any web serivice) doesn't stop Teamviewer to connect from an unknown device. Then I've tried to check which port Teamviewer is using to connect,

Before connect, port using by TeamViewer daemon

[arif@arif:~]$ sudo netstat -tulpn | grep teamviewer
tcp        0      0 127.0.0.1:5940          0.0.0.0:*               LISTEN      24323/teamviewerd  

After Connecting with remote destop,

[arif@arif:~]$ sudo netstat -tulpn | grep teamviewer
tcp        0      0 127.0.0.1:5940          0.0.0.0:*               LISTEN      24323/teamviewerd   
udp        0      0 0.0.0.0:42275           0.0.0.0:*                           24323/teamviewerd 

So I thought now I have to block port 5940 and 42275 instead of 5938 and I did as following,

[arif@arif:~]$ sudo iptables -L | head -n 4
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       udp  --  anywhere             anywhere             udp dpt:42275 MAC ! xx:xx:xx:xx:xx:xx
DROP       tcp  --  anywhere             anywhere             tcp dpt:5940 MAC ! xx:xx:xx:xx:xx:xx

But when I tried again to connect, it got connected successfully and this happened,

[arif@arif:~]$ sudo netstat -tulpn | grep teamviewer
tcp        0      0 127.0.0.1:5940          0.0.0.0:*               LISTEN      24323/teamviewerd   
udp        0      0 0.0.0.0:34775           0.0.0.0:*                           24323/teamviewerd  

And there is nothing going on port 80 and 443,

[arif@arif:~]$ sudo netstat -plnt | grep ':80'     
[arif@arif:~]$ sudo netstat -plnt | grep ':443'
[arif@arif:~]$ 

Question:

How can I block these kinds of application which use random port to connect.

  • 1
    You are doing it the wrong way: you should not block specific ports (black listing) but you should block access to everything unless you really need it (white listing). This means default policy for INPUT should be DENY and then you can add INPUT rules with ALLOW for the services you really need - if there are any services at all on your machine which need to be accessed from outside. – Steffen Ullrich Jul 17 '17 at 7:09
1

Why not just whitelist the ports that you want to access instead of trying to blacklist every single one of them? You know that YOU will want to connect to your device, whitelist the services that you will be using and you should be good to go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.