Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently set up an Ubuntu Server at home, and the first thing I did was place the UFW firewall at full power. Bad move. I could not even "rlogin" to it.

I just disabled the firewall, and would like to set it up correctly.

These are the goals for this server:

  • File server.
  • Dynamic IP updating at openDNS.com (I have a couple of machines at home connected through a linksys router.)
  • Web server.

What ports should I not block?

share|improve this question
1  
I presume you mean ssh, and not actual rlogin? –  theotherreceive Jul 28 '09 at 5:39
1  
you should probably edit that "not" back into the title. –  dlamblin Jul 28 '09 at 5:58

5 Answers 5

Don't "block" any ports. Since you control the server then the only ports that will be open (as in, with something listening on the port) will be where you have decided to run a service that uses that port.

Outgoing traffic:

  • I wouldn't filter any of that, if anyone compromised your server they could just disable the firewall rules.

Incoming traffic:

  • Rather than blocking ports, you need to make sure that the ports you have listening are only accessed from locations that you want them accessed from - you probably don't want to open up your samba network to the internet. You may also want to restrict where your web/ssh server can be accesssed from
  • You only need port 53 if you have a DNS server, you don't need it open just to use opendns.
share|improve this answer
    
I disagree. Everything should be blocked by default. Then open only the ports you actually use. This is "Firewall 101". If you don't want to do it right you might as well not bother. –  hotei Aug 30 '10 at 4:58

It might be worth pointing out that rlogin has several serious security issues. It's probably best you did not use it. In addition to the ports mentioned for your goals, keep port 22 open for SSH.

share|improve this answer
    
I often hear people using telnet... but rlogin? lamcro, you're seriously out of date. (Even though in recent distros, rlogin is symlinked to ssh.) –  grawity Jul 28 '09 at 6:43
    
I'm a sysadmin noob. Sorry. –  lamcro Aug 4 '09 at 14:48

135,137,138, and 139 are all used for NetBIOS, which is needed for Samba (Probably your best bet for a file server, unless you're going web based). Samba also needs 445 (smb).

The default port for DNS is 53.

For a webserver, obviously port 80 for standard http, unless you plan on needing https for security reasons, then you will need 443 as well :)

share|improve this answer
    
s/OpenDNS/DNS/ - and don't forget 22 for SSH. –  grawity Jul 28 '09 at 6:48

Keep these incoming ports open for the reasons described,

  1. SSH port (tcp/22) for remote access to the server
  2. File server ports (depending on which services you are using; SAMBA, NFS, (S)FTP, et al)
  3. If you have a Web server running -- tcp/80 and|or tcp/443 as required

Your tags suggest you have a linksys device on the Internet path.
Consider using its firewall to limit Internet inbound traffic.

share|improve this answer

If you want to have more services running on the box in the future, check out this list of ports to see what port(s) your service needs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.