Should I use my firewalls port forwarding feature or have my services listen on alternative ports?

Question

I have an VPS with which I run my own email server sitting out in the ether of the internet which I have SSH access to. My my logging shows I'm getting 500 or so failed attempted connections per day and so I would like to close the default SSH port and open an alternative and I would like to access my SMTP service from an additional port as my ISP blocks port 25.

The server is Debain Squeeze running Postfix and OpenSSH and using Shorewall as the firewall.

Assuming the above is considered good practice (if not, please advise me on how I should achieve my objectives), should I use port forwarding on my firewall or have the services run on alternative ports and open/block the appropriate ports using the firewall? Specifically I'd like to know why one method is preferred over the other.

Answer 1

Alternative Ports

Services can be run for any number of reasons (both good and bad). The typical good reasons are:

• running the service on a non-privileged port
• getting around inconvenient port filtering
• service modification such that it doesn't have typical behavior

Port Forwarding

Port forwarding is generally done as a security measure where as port filtering is not (or at least shouldn't be). Port filtering is also generally run with a firewall separate from the service, usually by having the firewall run on a separate server. This helps to contain (limit) some of the possible vulnerabilities from running the service. Reasons for port filtering:

• security
• service/server separation

Answer 2

I would change the ports in the services themselves.

For sshd, this is easy, just modify the /etc/ssh/sshd_config and change the Port directive. Make sure you have an alternative way to get in in case something goes wrong.

For postfix, depending on your situation, you will probably want to enable an additional port to listen on rather than replacing port 25 (as incoming server to server mail will stop if you don't have 25 open). Edit master.cf, and look for the smtpd line and add an additional line for the port you want to listen on (2525 in this example):

  25      inet  n     -     n     -     -     smtpd
2525      inet  n     -     n     -     -     smtpd

Also, consider changing to an ISP that doesn't block ports without the ability to opt-out.

The main advantage of doing it this way is reduced complexity - you want these ports listened on by the services, and introducing another component (iptables) to do it for you adds to the complexity. I would say that keeping things simple is high on the list in making these types of decision.

Answer 3

I'd tend to suggest changing ports at the firewall as opposed to the services - should you choose to switch other ports, or servers, you'd only need to migrate the firewall rule as opposed to chasing down half a dozen different configurations.