Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

What are the minimum ports and services that should I allow/open for listen and/or transmit in my firewall (I am using Firestarter) to keep my internet running ok?

Some talk about what services, which port uses, and why it matters should be nice too.

Thanks for any advice. I have some bet to the answer>

80 http
443 https
53 dns

EDIT: I will just browse some sites. I have a windows virtual machine, so I ll use it too, bu t just normal navigation too. No torrents, IRC's, FLASH, etc.. Thanks for attention.

hmmm... lost! Linux Mint 9 here.

share|improve this question

closed as off topic by Thomas W., jokerdino, Jorge Castro, jrg May 29 '12 at 13:49

Questions on Ask Ubuntu are expected to relate to Ubuntu within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
This is offtopic here (since you've mentioned "Mint" as the OS). See the FAQ: This is not the right place for: Linux Mint, Backtrack, and other Linux distributions (try our friends at Unix & Linux Stack Exchange). –  Thomas W. May 29 '12 at 12:56
add comment

4 Answers 4

I generally run a closed firewall with only necessary ports open. Some of the traffic you need to allow (outgoing unless otherwise specified):

  • Establised, related (short circuits access for open connections) bi-directional.
  • ICMP types 3 and 4 incoming, and 11 outgoing
  • UDP port 123 for NTP.
  • UDP and TCP port 53 for DNS.
  • TCP ports 25 and 587 for STMP email transmission
  • TCP ports 143 and 993 for IMAP reading email (and/or POP)
  • TCP ports 80 and 443 for HTTP/HTTPS web browsing. Plus whatever non-standard ports you want to support.
  • Whatever ports need to be open for any streaming media you want to support,
  • Ports for other services like SSH (TCP/20), FTP (TCP 20,21) you wish to use.
  • Incoming ports for any services you wish to provide. (You may want to limit some access to the local network.)

A package like Shorewall will make it easier to configure your firewall policies and rules. The example configurations (1, 2, and 3 interface variations) provide a good starting point.

share|improve this answer
    
nice answer. Thanks. –  H_7 Apr 8 '12 at 14:12
add comment

The Firestarter wizard and the default settings on the Ubuntu firewall are usually good for most. Changing them can expose you to unanticipated security risks. If you can get to the Internet now, your're probably fine.

You can try trial and error to customize your settings in firestarter.

I open inbound ports 631(Printing), 137-139 and 445(samba) only to my LAN.
If you want more secure to the outside you can set Outbound to restrictive by default and only open the ports you absolutely need exposed.

share|improve this answer
add comment

The most normal setup would be any outgoing and established incoming.

A more secure setup would be

80-http
443-https
53-dns
67-dhcp outgoing and established  
68-udp incoming.  

Without a comprehensive list of what applications you plan to run, this question is unanswerable.

Will you expect RTSP etc to work for flash?
Do you plan on running any other streaming services?

I put it out there for you, but I really think this one isn't properly answerable.

If all you run is PURE http and https outbound 80/443 and inbound established should work for you. This may kill flash/embedded media though.

share|improve this answer
    
I made some changes in question, hope this helps to answer a correct and complete answer. –  H_7 Apr 8 '12 at 2:26
    
I have connection issues with just this 2 opened.. already tryed. –  H_7 Apr 8 '12 at 2:33
    
There you go...try that –  hbdgaf Apr 8 '12 at 2:37
    
I guess... yes, I am, sir. –  H_7 Apr 8 '12 at 2:40
add comment

The minimum is relative to what apps you want to be able to connect to the internet. So you'd first have to decide what apps you want connecting. But let's say you just want Ubuntu updates and a web-browser to have connections. And you just want the most basic connections for the web-browser:

You will need to allow outgoing on ports

53/udp 67/udp 80/tcp 443/tcp

You will also need to allow outgoing for key exchanges for ubuntu packages

11371/tcp

If you want the time to check with the internet for accuracy

123/udp

These would all be basic connections that most everyone will use.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.