What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

Question

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the non-standard port I'm using for SSH connections.

But seeing as how my server already only has services running on those ports anyway, would it just be pointless? I don't really have a need right now to region-block IPs or anything complex like that.

In simple words that someone with a not-so-complete understanding of IP networking can understand, would it still be useful for me to configure a firewall in this way? How, functionally, is it different from just continuing to not run services on the ports I would block?

Answer 1

TL;DR

It protects against having to manually configure services to only listen on localhost, as you have to manually allow them network connectivity, and it increases the effort an attacker must exert to recon your box. This means it's an effective tool both against attackers and poor configuration. Yes, you should run a firewall.

Detail

Ports have 2 main states:

1. Open (Service is listening)
2. Closed (There is nothing listening)

You appear to be familiar with the two states - ports default to "closed", switching to "open" if there is a service listening. It's very fast to enumerate both open and closed ports - the OS will actually send a response saying either "there is a service here" (port is open), or one saying "there is no service here" (port is closed).

If you use a firewall, it provides the option to filter ports. For filtered ports, the OS does not respond at all. This means an attacker must invest more time to determine port states, as they have no way to know if the computer didn't send any response, or if the response was lost in transit.

Additionally, if you're running a firewall, you protect yourself against accidentally exposing additional services to the Internet.

I've included a sample scan of my desktop with my firewall off (pay special attention to the number of ports discovered, and how long the scan took):

$ nmap 192.168.1.26

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-24 21:41 EST
Nmap scan report for TehPwner (192.168.1.26)
Host is up (0.00017s latency).
Not shown: 987 closed ports
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
902/tcp   open  iss-realsecure
912/tcp   open  apex-mesh
2869/tcp  open  icslap
5357/tcp  open  wsdapi
8081/tcp  open  blackice-icecap
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49163/tcp open  unknown
49176/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 2.30 seconds

Now I've enabled my firewall:

$ nmap 192.168.1.26

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-24 21:42 EST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn

Nmap done: 1 IP address (0 hosts up) scanned in 3.03 seconds

Once more, skipping the ping probe:

$ nmap 192.168.1.26 -Pn

Starting Nmap 6.40 ( http://nmap.org ) at 2015-01-24 21:42 EST
Nmap scan report for TehPwner (192.168.1.26)
Host is up (0.00090s latency).
Not shown: 996 filtered ports
PORT     STATE SERVICE
902/tcp  open  iss-realsecure
912/tcp  open  apex-mesh
2869/tcp open  icslap
5357/tcp open  wsdapi

Nmap done: 1 IP address (1 host up) scanned in 49.29 seconds

Answer 2

In the ideal world, an open port without any services running behind it is the same as a port that is not opened. In the real world, humans make mistakes. The less control you have on a system, the more likely any attack on your system would be amplified by a mistake.

A firewall serves to mitigate your mistake by adding an additional layer of control to your computer system. It does so by accepting, rejecting or dropping connections based on your configuration. As a side effect, it helps to reduce your attackers' ability to fingerprint your operating system (OS) to launch more targeted attacks.

If you are not familiar with your OS, there is a likelihood that you would accidentally re-enable disabled services or start new services that are installed via a system upgrade. Unless you consistently do a check using program such as netstat, these services would be quietly listening for incoming connections without your knowledge. Some of which may, over the course of time, become vulnerable to attacks and provide gap for an attacker to breach your system.

By running a firewall and blocking ports without active services, you are essentially hardening your system by providing redundancy in the event that a security control fails or a vulnerability is exploited during the system's life cycle. This approach is known as defense in depth.