Block port 111 on centos 7

Question

I am using a server with centos 7 running kvm/virtualization, I access using VNC server.

Today I received an warning about my server being used to attack other server using port 111, I am completely lost. My password for the server is very very hard, I doubt someone could force it in years... the problem is, I need to protect, Is it possible to disable this port ? Do I need it ? I used

netstat -l

while on the machine and didn't see any 111 occurrence, so if I block, Can I still log into the machine and keep working ? If yes, how can I do this ? I tried this iptables -A INPUT -p tcp -s! 192.168.0.0/24 --dport 111 -j DROP iptables -A INPUT -p tcp -s 127.0.0.1 --dport 111 -j ACCEPT

but didn't work, output:

Bad argument `192.168.0.0/24'

Is there a way to block it, or make it only usable to my local network/localhost (if block will block the server access)?

The warning I received:

A public-facing device on your network, running on IP address (IP ADDRESS), operates a RPC port mapping service responding on UDP port 111 and participated in a large-scale attack against a customer of ours, generating responses to spoofed requests that claimed to be from the attack target.

Please consider reconfiguring this server in one or more of these ways:

1. Adding a firewall rule to block all access to this host's UDP port 111 at your network edge (it would continue to be available on TCP port 111 in this case).
2. Adding firewall rules to allow connections to this service (on UDP port 111) from authorized endpoints but block connections from all other hosts.
3. Disabling the port mapping service entirely (if it is not needed).

I am not using any firewall.

Answer 1

You are a little wrong with iptables command. Try this:

iptables -A INPUT -p udp -s 192.168.0.0/24 --dport 111 -j ACCEPT
iptables -A INPUT -p udp -s 127.0.0.1 --dport 111 -j ACCEPT
iptables -A INPUT -p udp --dport 111 -j DROP

This will allow connections to port 111 from localhost (127.0.0.1) and from network 192.168.0.0. All other connections will be dropped.
Note, your warning recommends to block UDP, not TCP. I replaced protocol in example.

Answer 2

If you don't need rpcbind then:

systemctl stop rpcbind.socket
systemctl disable rpcbind.socket

See https://unix.stackexchange.com/questions/369937/fedora-25-and-disabling-whatever-is-listening-on-port-111/

If you don't use something then it's stupid and less secure to leave it turned ON and then filter it with a firewall. Recommendation number 3 in the description should be number 1.