1

Recently I was trying to restrict incoming traffic to my laptop on all ports except those which are essential in work of such protocols as http, https, ssh. I was using iptables as a netfilter configuration solution. But after entering this command

sudo iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 80,443,53,21,22 -j DROP

to restrict access to all ports except: 80, 443, 22, 53(for DNS to work), 21, 22, I obtained non-working Mozilla Firefox. Please suggest, what other ports I should leave opened for Firefox and several system tools(dnf, snap, flatpak) to work properly?

5
  • You are misunderstanding how firefox uses ports ...
    – DavidPostill
    Nov 11, 2019 at 21:41
  • Could you please clarify your answer? What exactly I'm misunderstanding? As far as I know, web browser just automates transmission of http requests via globally defined ports(80, 443)
    – dragonhaze
    Nov 11, 2019 at 21:59
  • If you are using a personal laptop and do not plan to communicate with / access another PC on the same network, you can might as well deny all incoming connections. Your browser acts as a TCP client. So it will establish a connection with the website which your firewall will recognize as an outgoing connection and allow the wesite's responses through the firewall.
    – Ganesh R.
    Nov 11, 2019 at 23:46
  • Are you doing this to restrict the useability of your device or to secure the device from outside traffic?
    – Ecstasy
    Nov 15, 2019 at 15:46
  • To secure device from outside traffic
    – dragonhaze
    Nov 19, 2019 at 14:47

2 Answers 2

0

The ports that you have listed are the "well-known" destination ports for certain protocols, but that doesn't mean they are used as the source port as well. The source port is actually picked from a random range and often used as the destination/incoming port for the replies. So to achieve want you want with your approach, ports from that range should be left open instead. Also, your rule only blocks certain incoming TCP traffics anyway.

So to do it "statlessly" (that is, in this case, purely port-based):

iptables -A INPUT -p tcp ! --dport 32768:60999 -j DROP
iptables -A INPUT -p udp ! --dport 32768:60999 -j DROP

As noted in the link above, the actual range can be checked with:

cat /proc/sys/net/ipv4/ip_local_port_range

A perhaps more reassuring approach (maybe only seemingly though, if you don't adopt it in addition to the above; as the source port does not really guarantee anything) is to filter incoming replies based on their source ports (which are often the destination ports of the original request):

iptables -A INPUT -p tcp -m multiport ! --sports 80,443,53,22 -j DROP
iptables -A INPUT -p udp -m multiport ! --sports 53 -j DROP

But since not all applications/protocols works purely/exactly this way, you will likely need some more exceptions (e.g. FTP? or even the no-longer-simple-these-days DNS) anyway.

To avoid these complications, you probably want to do it with a stateful approach:

iptables -A INPUT -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP

Basically this means traffics initiated by others will be dropped.

You might still want some more exceptions (for the loopback interface and ICMP). Check out this wiki page for more details and examples. (This might be good enough to use by the way.)

0

This assumes you want to only allow traffic that you have requested:

Drop all incoming traffic: iptables -I INPUT -j DROP

Allow any specific port you want to connect to from another device: iptables -I INPUT -p (proto) --dport=(port) -j ACCEPT

Allow related and established traffic: iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .