2

I recently set up an Ubuntu Server at home, and the first thing I did was place the UFW firewall at full power. Bad move. I could not even "rlogin" to it.

I just disabled the firewall, and would like to set it up correctly.

These are the goals for this server:

  • File server.
  • Dynamic IP updating at openDNS.com (I have a couple of machines at home connected through a linksys router.)
  • Web server.

What ports should I not block?

Improve this question
2
  • 1
    I presume you mean ssh, and not actual rlogin?
    – theotherreceive
    Jul 28, 2009 at 5:39
  • 1
    you should probably edit that "not" back into the title.
    – dlamblin
    Jul 28, 2009 at 5:58

5 Answers 5

Reset to default
3

Don't "block" any ports. Since you control the server then the only ports that will be open (as in, with something listening on the port) will be where you have decided to run a service that uses that port.

Outgoing traffic:

  • I wouldn't filter any of that, if anyone compromised your server they could just disable the firewall rules.

Incoming traffic:

  • Rather than blocking ports, you need to make sure that the ports you have listening are only accessed from locations that you want them accessed from - you probably don't want to open up your samba network to the internet. You may also want to restrict where your web/ssh server can be accesssed from
  • You only need port 53 if you have a DNS server, you don't need it open just to use opendns.
Improve this answer
1
  • I disagree. Everything should be blocked by default. Then open only the ports you actually use. This is "Firewall 101". If you don't want to do it right you might as well not bother.
    – hotei
    Aug 30, 2010 at 4:58
3

It might be worth pointing out that rlogin has several serious security issues. It's probably best you did not use it. In addition to the ports mentioned for your goals, keep port 22 open for SSH.

Improve this answer
2
  • I often hear people using telnet... but rlogin? lamcro, you're seriously out of date. (Even though in recent distros, rlogin is symlinked to ssh.)
    – u1686_grawity
    Jul 28, 2009 at 6:43
  • I'm a sysadmin noob. Sorry.
    – lamcro
    Aug 4, 2009 at 14:48
3

135,137,138, and 139 are all used for NetBIOS, which is needed for Samba (Probably your best bet for a file server, unless you're going web based). Samba also needs 445 (smb).

The default port for DNS is 53.

For a webserver, obviously port 80 for standard http, unless you plan on needing https for security reasons, then you will need 443 as well :)

Improve this answer
1
  • s/OpenDNS/DNS/ - and don't forget 22 for SSH.
    – u1686_grawity
    Jul 28, 2009 at 6:48
2

Keep these incoming ports open for the reasons described,

  1. SSH port (tcp/22) for remote access to the server
    • File server ports (depending on which services you are using; SAMBA, NFS, (S)FTP, et al)
    • If you have a Web server running -- tcp/80 and|or tcp/443 as required

Your tags suggest you have a linksys device on the Internet path.
Consider using its firewall to limit Internet inbound traffic.

Improve this answer
1

If you want to have more services running on the box in the future, check out this list of ports to see what port(s) your service needs.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .