Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

What are the minimum ports and services that should I allow/open for listen and/or transmit in my firewall (I am using Firestarter) to keep my internet running ok?

Some talk about what services, which port uses, and why it matters should be nice too.

Thanks for any advice. I have some bet to the answer>

80 http
443 https
53 dns

EDIT: I will just browse some sites. I have a windows virtual machine, so I ll use it too, bu t just normal navigation too. No torrents, IRC's, FLASH, etc.. Thanks for attention.

hmmm... lost! Linux Mint 9 here.

share|improve this question

closed as off topic by Thomas W., jokerdino, Jorge Castro, jrg May 29 '12 at 13:49

Questions on Ask Ubuntu are expected to relate to Ubuntu within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

This is offtopic here (since you've mentioned "Mint" as the OS). See the FAQ: This is not the right place for: Linux Mint, Backtrack, and other Linux distributions (try our friends at Unix & Linux Stack Exchange). –  Thomas W. May 29 '12 at 12:56

4 Answers 4

I generally run a closed firewall with only necessary ports open. Some of the traffic you need to allow (outgoing unless otherwise specified):

  • Established, related (short circuits access for open connections) bi-directional.
  • ICMP types 3 and 4 incoming, and 11 outgoing
  • UDP port 123 for NTP.
  • UDP and TCP port 53 for DNS.
  • TCP ports 25 and 587 for SMTP email transmission
  • TCP ports 143 and 993 for IMAP reading email (and/or POP)
  • TCP ports 80 and 443 for HTTP/HTTPS web browsing. Plus whatever non-standard ports you want to support.
  • Whatever ports need to be open for any streaming media you want to support,
  • Ports for other services like SSH (TCP/22), FTP (TCP 20,21) you wish to use.
  • Incoming ports for any services you wish to provide. (You may want to limit some access to the local network.)

A package such as Shorewall will make it easier to configure your firewall policies and rules. The example configurations (1, 2, and 3 interface variations) provide a good starting point.

share|improve this answer
nice answer. Thanks. –  H_7 Apr 8 '12 at 14:12
I opened up all these ports, and still can't browse. There's either something missing in this list or iptables is retarded. –  Cestarian Aug 29 at 3:47
@Cestarian If you still can't browse after enabling outgoing traffic on the ports above you may have other issues. Do you have a static IP? or did you get an auto config IP? You may need to enable the DHCP ports to get the IP address configured. This will be bi-directional traffic. Alternatively, assign a static IP address. –  BillThor Aug 29 at 4:07
I was using DHCP –  Cestarian Aug 29 at 13:12
SSH is port 22, not port 20 –  jordanbtucker Sep 19 at 8:37

The Firestarter wizard and the default settings on the Ubuntu firewall are usually good for most. Changing them can expose you to unanticipated security risks. If you can get to the Internet now, your're probably fine.

You can try trial and error to customize your settings in firestarter.

I open inbound ports 631(Printing), 137-139 and 445(samba) only to my LAN.
If you want more secure to the outside you can set Outbound to restrictive by default and only open the ports you absolutely need exposed.

share|improve this answer

The most normal setup would be any outgoing and established incoming.

A more secure setup would be

67-dhcp outgoing and established  
68-udp incoming.  

Without a comprehensive list of what applications you plan to run, this question is unanswerable.

Will you expect RTSP etc to work for flash?
Do you plan on running any other streaming services?

I put it out there for you, but I really think this one isn't properly answerable.

If all you run is PURE http and https outbound 80/443 and inbound established should work for you. This may kill flash/embedded media though.

share|improve this answer
I made some changes in question, hope this helps to answer a correct and complete answer. –  H_7 Apr 8 '12 at 2:26
I have connection issues with just this 2 opened.. already tryed. –  H_7 Apr 8 '12 at 2:33
There you go...try that –  hbdgaf Apr 8 '12 at 2:37
I guess... yes, I am, sir. –  H_7 Apr 8 '12 at 2:40

The minimum is relative to what apps you want to be able to connect to the internet. So you'd first have to decide what apps you want connecting. But let's say you just want Ubuntu updates and a web-browser to have connections. And you just want the most basic connections for the web-browser:

You will need to allow outgoing on ports

53/udp 67/udp 80/tcp 443/tcp

You will also need to allow outgoing for key exchanges for ubuntu packages


If you want the time to check with the internet for accuracy


These would all be basic connections that most everyone will use.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.