8

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?

  • 3
    "I usually am not sure which one the application uses?" Then ask for help. Ask others "which protocols/ports do xxxx uses?" or rather, ask "how do I determine which protocols/ports xxxx uses?" You cannot properly configure a firewall if you have no idea which network protocols are used. – curiousguy Nov 19 '11 at 15:53
  • 1
    You are right, but that is why I'm asking, is worth knowing, does it make any difference. If it does I'll look into it. – enedene Nov 19 '11 at 18:19
  • I am actually saying that a firewall hurts more than it helps when used by less-than-experts (it can cause a lot of confusion, and does not protect much, if at all). I know that this is not exactly the consensus in the security community. So I am actually suggesting to not enable the firewall in the first place. – curiousguy Nov 19 '11 at 20:14
  • @curiousguy Windows Vista/7's firewall has actually come a long way in preventing the confusion you're talking about (unlike most/all third party firewalls, which block ^%&%ing everything), so I think think it's very true anymore that only someone with a Computer Science degree should have an active firewall. – Ben Brocka Nov 20 '11 at 2:59
  • 4
    These days everyone should be running a firewall. Windows firewall is now very good out of the box, for a home user. @Gowenfawr's answer is good. – Rory Alsop Nov 21 '11 at 0:03
13

So, SSH needs port 22/tcp. You're asking if opening 22/tcp and 22/udp presents a security vulnerability. The answer is "no" if nothing is listening to 22/udp. If some other application is listening to 22/udp, an application which you wouldn't want open to other hosts, then it could. There are such combinations (syslog and rsh share 514, for example).

That being said, there's really not much excuse for not knowing which an application uses. On Linux, for example, you can use "netstat -tunlp" or "lsof -i" to see which program is listening to which port(s), and tune your firewall rules correctly.

  • You don't have to have the software running to find its port. The very most ports are listed in /etc/services. – freddyb Nov 20 '11 at 3:52
  • 4
    /etc/services lists expectations but not necessarily realities, especially for anything that isn't standard, low, and reasonably old. For example, squid is going to open several ports (56624/udp? huhwhat?) that services doesn't know anything about, and services thinks that squids actual proxy port (3128/tcp) is ndl-aas (the Active API Server Port, of course!) – gowenfawr Nov 20 '11 at 16:01
0

Just want to expand on @gowenfawer 's really outstanding answer.

Even if a process is not currently listening on a specified port, that might not be true in the future...

IE: Somebody is hosting a SMTP server; it shifts mail around. There's no webserver on it, so the admin leaves ports tcp/80 & TCP/443 wide open. Neither Apache or Nginx are running on it, so why bother writing an iptables rule?

Then someone hacks his mailserver and starts running a webserver hosting illegal content: could be porn, malware, who knows; the mind boggles at what the miscreant could serve from somebody else's server. Indeed, a smart skunk doesn't stink-up their own hole: people who do that sort of thing are going to use other folk's servers.

Had those ports been preemptively filtered, disaster would have been averted. Remember: you're only paranoid when they're not really out to get you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.