Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is it necessary to configure a firewall like iptables or firestarter when the goal is only to surf safely?

For me, there is no need to open any port (i.e. samba, etc.).

share|improve this question
2  
Judging by the confusion in some answers below, I think you could improve your question by specifically stating what type of "safety" you're after. Are you interested in safety and anonymity? –  nutty about natty Mar 21 '13 at 9:53
    
From the FAQ: "Your questions should be reasonably scoped. If you can imagine an entire book that answers your question, you’re asking too much." It's my opinion that this question, most probably unintentionally, is too broadly scoped. –  user25656 Mar 21 '13 at 10:58

4 Answers 4

up vote 0 down vote accepted

No, you don't need it if all you want to do is surf safe. However you can take the following steps:

  • There are several add-ons available that can block NSFW content and ads.
  • You can use a proxy or a VPN to surf anonymously.
  • You can use TOR for some anonymity as well.
share|improve this answer
    
Thanks for your quick answer, the goal is not to surf anonymously, but deny things as pings, udp... –  Tim Mar 21 '13 at 8:14
1  
@Tim There's no need to accept an answer, if it doesn't answer your question (or at least help you towards an answer). –  nutty about natty Mar 21 '13 at 9:29
1  
@Tim If you like an answer, you can upvote it; in fact, you can upvote many answers, but you can only accept one single answer; there's no rush in accepting, and you can also un-accept. –  nutty about natty Mar 21 '13 at 9:37

If you're using Firefox (recommended), NoScript by Giorgio Maone is a great option worth considering!

The NoScript website itself looks a bit messy; don't let that give you the wrong impression, though!

The NoScript Firefox extension provides extra protection for Firefox, Seamonkey and other mozilla-based browsers: this free, open source add-on allows JavaScript, Java, Flash and other plugins to be executed only by trusted web sites of your choice (e.g. your online bank).

NoScript also provides the most powerful anti-XSS and anti-Clickjacking protection ever available in a browser.

NoScript's unique whitelist based pre-emptive script blocking approach prevents exploitation of security vulnerabilities (known and even not known yet!) with no loss of functionality...

You can enable JavaScript, Java and plugin execution for sites you trust with a simple left-click on the NoScript status bar icon (look at the picture), or using the contextual menu, for easier operation in popup statusbar-less windows.
Watch the "Block scripts in Firefox" video by cnet.

Staying safe has never been so easy!
Experts do agree...

Additionally, you may want to refer to Should I use No-Script?

share|improve this answer

Here are simple iptables rules that are helpful to deny things as pings and other unwanted input connections:

 # Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

 # Accepts all established inbound connections
 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

 # Allows all outbound traffic
 # You could modify this to only allow certain traffic
 -A OUTPUT -j ACCEPT

You will find more details here.

share|improve this answer

If you're behind router and it uses network address translation (NAT) to share a single public IP assigned by your ISP, among computers in your LAN, I'd say you're pretty much safe and you don't need to set up addition firewall or iptables rules.

Because NAT, by default, will drop any unsolicated incoming traffic from the Internet when reaches your router. So in effect it also acts as a firewall that prevents incoming requests from reaching your computer

This also why when you need to access a service in your LAN from outside the network eg IP camera, you must set up a port forwarding on your router to allow the request to reach the service

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.