1

I really hope that someone here. I'm setting up an Ubuntu server behind a corporate firewall. I'm trying to get repositories to work. The problem I have found it that it is not that straight forward. For archive.ubuntu.com I have opened firewall ports 80 and 443, but then you also need port 11371 to keyserver.ubuntu.com. There are plenty more addresses and ports that needs to be opened to get everything to work properly.

So my main question is, is there a comprehensive list of all addresses and ports that need to be open in a cooperate firewall for apt to work?

5
  • Thanks for your response. Unfortunately the links do not provide what I'm looking for. They only show how you connect through a proxy. Apr 9, 2020 at 14:28
  • These days Ubuntu Server should be able to get updates on port 80 only.
    – Jos
    Apr 9, 2020 at 14:54
  • Do you have to whitelist outgoing traffic from the server, or is there an internal proxy server in the company you can use?
    – vidarlo
    Apr 9, 2020 at 15:26
  • To my knowledge we don't have a proxy so I'm forced to do whitelisting. Apr 10, 2020 at 15:10

2 Answers 2

0

Under /etc/apt/sources.list you can look up your sources and what port you are gonna need is something you have to check per source.

So, this may be outdated or datacenter specific. But I believe the following ports

86323 56421 12921 53 22

Another thing is if you are in a cooperate network are you sure you have all the right privileges to get this done?

Actually, in some cases, you are better of mirroring the repository server within the cooperation.

1
  • 1
    86323 is not even a valid port number. Things these days is distributed over HTTP(S), which means 80 and 443. In addition you need working DNS, but that doesn't imply opening port 53 from the server towards the internet.
    – vidarlo
    Apr 9, 2020 at 14:50
0

So my main question is, is there a comprehensive list of all addresses and ports that need to be open in a cooperate firewall for apt to work?

Plain and simple: No. There ain't. Because apt can be configured to use any repositories you want.

Even with the default, tld.archive.ubuntu.com, this is difficult. It redirects to other. Consider for instance no.archive.ubuntu.com:

$ dig no.archive.ubuntu.com +short
ubuntu-archive.trivini.no.
ftp.acc.umu.se.
194.71.11.173
194.71.11.165

These may very well change from time to time, so if you whitelist (based on DNS preferably) you will have to make sure your firewall solution updates it from time to time.

In addition to the local archive (probably se.archive.ubuntu.com in your case), you should add security.ubuntu.com to your whitelist. Both is accessible over port 80, normal HTTP.

For keys, you don't need open ports; you can fetch keys over http, and the number of keys is usually rather small, and you can add them manually. So I'd wager that you will manage with port 80 open towards tld.archive.ubuntu.com and security.ubuntu.com.

2
  • Thanks for your comments. I have done precisely what you described. It is quite frustrating when one whitelists a domain and it's subdomains and all of the sudden they do a change. I will have to talk with the network team for an alternate solution. Apr 10, 2020 at 15:07
  • You could have a look at where se.archive.ubuntu.com resolves, and use for instance ftp.acc.umu.se directly. This may be less volatile target.
    – vidarlo
    Apr 11, 2020 at 9:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .