I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered:

22, 80, 443, 9000

When reviewing /etc/csf/csf.conf I found out that the following incoming data UPD ports are unfiltered:

20, 21, 53

Should I filter these 3 so no one could try to access my system through them?

2 Answers 2


Are there any services listening on those UDP ports (output of netstat -lnup)? If not, then there is no risk in leaving these ports "unfirewalled", since the data will never reach any process.

However, it is common to block inbound traffic to all unused ports so that there aren't any surprises when new processes are launched.

  1. DNS uses TCP or UDP port 53. If you filter out [block] this port you may get problem at resolving the domain to IP address.
  2. Port 20 and 21 are associated with file transfer [FTP]; SSH is considered a better & secure approach so filtering out this shouldn't cause a issue.

But please keep in mind your current scenario and network first before filtering out a port or service.

You can further read about the well known ports at: https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

  • The filtering here is inbound only, so blocking the DNS port won't have an effect unless this system is a DNS server. Also, FTP uses TCP, not UDP, so #2 is not relevant here. Jan 10, 2018 at 22:05
  • 1
    The question is about incoming data. DNS requests initiated locally will not be affected by these rules as their reply packets will come through as RELATED or ESTABLISHED. The same goes for FTP. You don't need to mark incoming ports open for the replies from local requests; they will get through (unless you've done something really funky with your firewall). You only need them open if you need to allow requests that originate externally. Edit: also what @multithr3at3d says about FTP not using UDP. Jan 11, 2018 at 2:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .