52

Since a password is required to be a superuser (to install and modify programs), what are the risks to not use a firewall under Ubuntu ? More particularly if I am using a NAT router ?

7 Answers 7

40

It depends. Most people use a router between their desktop and the internet and by default there are no sigificant open ports, so in the vast majority of user cases a firewall adds very litte, if anything.

It can help if you inadvertantly install a server, such as VNC or SSH.

A better question is what do you want to use a firewall for ?

See:

https://wiki.ubuntu.com/SecurityTeam/FAQ#UFW

https://wiki.ubuntu.com/SecurityTeam/Policies#No_Open_Ports

https://help.ubuntu.com/community/UFW

If you want a graphical tool for your firewall, use gufw

enter image description here

4
  • Thx for your reponse. In fact I already use gufw with open port for my torrent client. And i must say this is more a windows habit, since using windows witout firewall is quite suicidal.
    – riimzzai
    Mar 3, 2013 at 16:29
  • Yes, Windows has a number of both documented and undocumented open ports, although it may be improving (have not used any version of Windows higher then XP).
    – Panther
    Mar 3, 2013 at 16:33
  • Even on Windows, NAT protects against more threats than most people realize. But I just don't see a good reason NOT to use a firewall.
    – davidcl
    Mar 3, 2013 at 18:16
  • 1
    @davidcl - Just take care not to enable UPnP on your router is all ;) Otherwise +1 to router (which come with firewall/NAT).
    – Panther
    Mar 3, 2013 at 18:22
11

It sounds like the question is about a host-based firewall on an Ubuntu PC.

IF the machine never leaves the NAT-based network (ie, it is not a laptop that you take to coffee shops and use on free wifi networks),

AND there are no ports open on your router that could be mapped to your Ubuntu machine,

AND your router doesn't have any features which helpfully open ports for you based on things that happen on your network (UPnP)

AND you will never have any other devices on your local network that might be compromised and attack your Ubuntu box,

THEN your system is probably secure without a host-based firewall.

However, if some of these things aren't true, or might become untrue in the future, a host-based firewall is a really good idea. Given the potential benefits and the limited drawbacks, why not enable it?

9

Using a NAT, if you have no port forwarding to your machine, it is not accessible from the internet unless you explicitly open a connection to it (with vnc or teamviewer for example) so I think there is no problem not using a firewall on it. The unique worry could come from internal (LAN) access but usually not the case on home lan.

3
  • Not true; read up on STUN traversal. There are many STUN-related flaws which allow external services to open up ports to machines inside the firewall.
    – fluffy
    Mar 3, 2013 at 20:37
  • Stun traversal is for voip clients to traverse the NAT/firewall so if you enable it (usually not needed), you are opening the machine for those ports anyway and you should take the appropriate measures of course (like not enabling UPnP on the router for example).
    – laurent
    Mar 3, 2013 at 23:39
  • STUN traversal is not 'for' anything, it's an artifact of how NAT works that has been taken advantage of for the purpose of improving peer-to-peer network protocols such as SIP and the like. It can be used for good. It can also be used for evil.
    – fluffy
    Mar 4, 2013 at 20:30
1

None whatsoever.

The function of a firewall is to block access to services that otherwise would allow it. Ubuntu has no listening services by default, so there is nothing to block. Further, since you are behind a NAT router, you already effectively have a firewall.

7
  • 3
    That is not completely true as some routers have UPnP and people inadvertanly enable desktop sharing (VNC). This leads to the most common crack I have seen on Ubuntu. Of course, they may well open the VNC port without thinking ... I think our position should be education rather then making over reaching generalizations and absolute claims.
    – Panther
    Mar 3, 2013 at 16:35
  • @bodhi.zazen, I don't see how you can enable it by accident, and if you went to the trouble of enabling it, I imagine you want it to work, so a firewall would be counter productive. It also defaults to prompting you for authorization when someone connects, so even if you left it on and didn't set a password, it still isn't going to let anyone in without your approval.
    – psusi
    Mar 3, 2013 at 18:19
  • Here's an example of how it can happen by accident: miket5au.blogspot.com/2011/03/beware-vnc-and-upnp.html Sometimes you want to desktop sharing on the LAN, but don't mean to enable it for the outside world.
    – davidcl
    Mar 3, 2013 at 18:26
  • That said, your host-based firewall probably doesn't help you in this scenario.
    – davidcl
    Mar 3, 2013 at 18:27
  • @davidcl, indeed, host based firewall would block it on the LAN too. And the first line of that article, he admits "I was careless". If you are careless enough to leave the front door open ( enable vnc without password or prompt ), then you can just as easily be careless enough to leave the gate open ( firewall ). Having the gate or not makes no difference if you don't leave the front door open.
    – psusi
    Mar 3, 2013 at 18:32
1

I think one of the most used firewall feature is to prevent "cracked" programs to check the license on internet. If the "cracked" application doesn't need to be update or doesn't use "online" features, you can prevent it to accessing the internet by setting up a specific firewall rule. Sad but true.

0

In general cases, being either public computers or computers without a secure connection such as those more or less hijacking internet connections from other users in adjacent ports (i.e. houses/apartments next door), then that alone - I think - would give an example of how a firewall (being discretion) could be the better part of valor, so to speak. Plus, they keep those around you from digging into your information whether it be personal or even just something goofy you might be screwing around with. The point is privacy.

When I say general, again, I mean places like public venues. Libraries where all and sundry before you use portable carriers such as USB anything, really, discs - even if you were to do something possibly rash such as take your own external hard drive elsewhere and plug it in, there's no guarantee that the subsequent port is protected by virus or spyware blockers and all of that could latch on and carry itself right back to your original home laptop/desktop, thus making itself at home.

So while there might not be a vehement need in a lot of cases for a firewall to protect against a lot of things, they certainly come in handy against certain - if isolated - cases.

0

In between, I found some interesting considerations about firewall.

The article explains the notion of "service listening", "open port" and "NAT router" which can be misunderstood to conclude that : - better with than without (even if you drive a tank, put your seatbelt on) and - think twice before doing something affecting the system (educational considerations)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .