14

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the non-standard port I'm using for SSH connections.

But seeing as how my server already only has services running on those ports anyway, would it just be pointless? I don't really have a need right now to region-block IPs or anything complex like that.

In simple words that someone with a not-so-complete understanding of IP networking can understand, would it still be useful for me to configure a firewall in this way? How, functionally, is it different from just continuing to not run services on the ports I would block?

  • Most (perhaps all) firewalls, would block all incoming connections and you would explicitly need to open up the ports on the firewall for the ones you allow. What you are saying is that everything is allowed by default and you want to block the ones you dont want to open up. This is non-standard. – user1720897 Jan 25 '15 at 2:35
  • 2
    No, that's not what I meant. Were I to implement a firewall, I'd do it with the "block everything except these ports" approach. – Garrett Albright Jan 26 '15 at 2:09
13

TL;DR

It protects against having to manually configure services to only listen on localhost, as you have to manually allow them network connectivity, and it increases the effort an attacker must exert to recon your box. This means it's an effective tool both against attackers and poor configuration. Yes, you should run a firewall.

Detail

Ports have 2 main states:

  1. Open (Service is listening)
  2. Closed (There is nothing listening)

You appear to be familiar with the two states - ports default to "closed", switching to "open" if there is a service listening. It's very fast to enumerate both open and closed ports - the OS will actually send a response saying either "there is a service here" (port is open), or one saying "there is no service here" (port is closed).

If you use a firewall, it provides the option to filter ports. For filtered ports, the OS does not respond at all. This means an attacker must invest more time to determine port states, as they have no way to know if the computer didn't send any response, or if the response was lost in transit.

Additionally, if you're running a firewall, you protect yourself against accidentally exposing additional services to the Internet.

I've included a sample scan of my desktop with my firewall off (pay special attention to the number of ports discovered, and how long the scan took):

$ nmap 192.168.1.26

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-24 21:41 EST
Nmap scan report for TehPwner (192.168.1.26)
Host is up (0.00017s latency).
Not shown: 987 closed ports
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
902/tcp   open  iss-realsecure
912/tcp   open  apex-mesh
2869/tcp  open  icslap
5357/tcp  open  wsdapi
8081/tcp  open  blackice-icecap
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49163/tcp open  unknown
49176/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 2.30 seconds

Now I've enabled my firewall:

$ nmap 192.168.1.26

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-24 21:42 EST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn

Nmap done: 1 IP address (0 hosts up) scanned in 3.03 seconds

Once more, skipping the ping probe:

$ nmap 192.168.1.26 -Pn

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-24 21:42 EST
Nmap scan report for TehPwner (192.168.1.26)
Host is up (0.00090s latency).
Not shown: 996 filtered ports
PORT     STATE SERVICE
902/tcp  open  iss-realsecure
912/tcp  open  apex-mesh
2869/tcp open  icslap
5357/tcp open  wsdapi

Nmap done: 1 IP address (1 host up) scanned in 49.29 seconds
  • This answer is about a firewall that drops on unwanted ports, which is probably preferable. The firewall could also be configured toreject on unwanted ports. In that case the result would be as with not running services - so still quickly scannable; at least Question Overflow's argument about accidentally opened ports is still valid. – Hagen von Eitzen Jan 25 '15 at 16:10
  • I think the first sentence of my TL;DR makes reference to accidentally opened ports / poorly configured services, though it is easy to lose -- I've added a bit to the detailed section to try and make it more obvious. – Wrycu Jan 25 '15 at 21:10
  • I like your TL;DR summary and examples but details are incorrect. A TCP port has only two intrinsic states: OPEN and CLOSED, with the former meaning that some program listens on it, and the latter signifying that no programs listen on it. If a network scanner can establish a TCP connection, it reports a port to be OPEN, if it finds no evidence of a listening program or firewall rejects connections, it reports a port to be CLOSED, and if it suspects that a program is listening but connection was dropped by firewall, it reports a port to be FILTERED. Hence, FILTERED is just an observed state. – mkalkov Jan 26 '15 at 21:09
  • I've finally managed to get around to enabling and configuring pf on my server. Frustratingly, though, the only way I can replicate your experience with nmap, where a scan without -Pn reports the host is down, is if I block all incoming traffic entirely; if I poke the holes for the ports I need, I get the same result with the firewall enabled as disabled, even with set block-policy drop. So in the end, I'm questioning what the point might be. =/ I'll leave it on, though… – Garrett Albright Feb 1 '15 at 22:41
10

In the ideal world, an open port without any services running behind it is the same as a port that is not opened. In the real world, humans make mistakes. The less control you have on a system, the more likely any attack on your system would be amplified by a mistake.

A firewall serves to mitigate your mistake by adding an additional layer of control to your computer system. It does so by accepting, rejecting or dropping connections based on your configuration. As a side effect, it helps to reduce your attackers' ability to fingerprint your operating system (OS) to launch more targeted attacks.

If you are not familiar with your OS, there is a likelihood that you would accidentally re-enable disabled services or start new services that are installed via a system upgrade. Unless you consistently do a check using program such as netstat, these services would be quietly listening for incoming connections without your knowledge. Some of which may, over the course of time, become vulnerable to attacks and provide gap for an attacker to breach your system.

By running a firewall and blocking ports without active services, you are essentially hardening your system by providing redundancy in the event that a security control fails or a vulnerability is exploited during the system's life cycle. This approach is known as defense in depth.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.