0

A firewall is for blocking / limiting access to specific service / port.

I know that it can be useful for allowing only certain IPs to a port (for example I don't want to have SSH open for the whole world).

Imagine that I have server that is running apache2 (port 80 & 443), SSH (port 22), mysql (it is bound to localhost, so it doesn't listen on a public interface).

Why should I even care to block all other ports except 22, 80 and 443, if there is no other service listening on it (for example on port 8080)?

Can someone explain this to me?

Improve this question
  • 1
    @mti2935 that's an inverse problem to this one? – schroeder♦ Nov 19 '19 at 22:20
  • This security.stackexchange.com/questions/76755 may help answer your question. – Henry WH Hack v3.0a Nov 19 '19 at 22:21
  • @HenryWHHackv2.1.3 so if I understand correctly, if I don't want to limit service to specific IPs or rate, then firewall for blocking ports like iptables is useless, only firewall which looks into data stream can be good, but nowdays are lot of streams encrypted anyways, so firewall cannot see it. – tomsk Nov 19 '19 at 22:32
  • Schroeder, I think the questions are similar in that both are asking what risks if any there are in [opening a hole in a firewall or not having any firewall at all] to allow access to a port on a server that has no service listening on it. – mti2935 Nov 19 '19 at 23:29
2

Blocking not in use ports is part of security in depth (or layered security) it makes it harder for an attacker to find unintentional publicly accessible services. And if an attacker manages to access the server through some exploit to not have an easy way to create a reverse shell.

It also makes it so that your server has less things to do (than continually drop packages for not in use ports. )

Improve this answer
  • 1
    Just adding that I wouldn't even consider any serious firewall that is not blocking everything by default. That's the only sensible way of using a device which job is separating you from a a no trust network where an open port on any random reachable endpoint takes literally minutes from startup to being actively brute forced. (Just try yourself opening port 22 for a bit with a secure sshd and be amazed how little lasts until the first attempt). That's commitment. – Jordi Nov 20 '19 at 0:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.