0

From that answer, and other comments on the same webpage, I came to the conclusion that ubuntu by default has an empty iptables. However, people said it was safe, because unless the unexperimented user were to install a web server, or any service talking on any port, no program would be trying to open any port.

I don't understand what that means. What does it mean to "open" a port, if the netfilter does nothing and basically allows any communication on any port? So, why is it safe?

Is it because, even if netfilter is allowing any incoming packet, since no service is listening, no harm can be done?

5
  • "since no service is listening, no harm can be done?" bingo.
    – muru
    May 3, 2022 at 23:59
  • Don't you think those explanations on the answer I quoted are a bit lacking, knowing they target beginners, who might no understand what is happening, and why the fact that just installing a web server changes the openness of a port? Naively, openness just evokes an opened door, which in that case doesn't make sense. May 4, 2022 at 0:07
  • @JonasDaverio you are welcome to improve those answers, or to add a better answer of your own. That's how AskUbuntu works.
    – user535733
    May 4, 2022 at 0:10
  • @user535733 I'm definitely not qualified enough, but I will leave a comment. May 4, 2022 at 0:10
  • I'm a pretty good source of info on firewalls and protection policies i will write up an answer in the morning on this
    – Thomas Ward
    May 4, 2022 at 0:12

1 Answer 1

1

In the absence of any firewall restrictions on the local machine, any applications running on the machine may listen for incoming communications or send outgoing communications.

There are some in-built limitations for this - for example only software running as "root" may listen on port numbers below 1024. But by and large, any application may send data or receive it.

This is fine if all the software on your machine is trusted, but if you should happen to have any malware running on the machine, or any software that has vulnerabilities, its unfettered access to incoming and outgoing communication could be a problem.

On a typical home network connection, your home will have a router that has sensible firewall rules. For example, it will typically have rules that will deny any incoming connection from the internet that is not part of a communication that was established from inside the network. Indeed, IPv4 communication will usually be using NAT where this is mandatory. It may also block all communication on port 25 (crucial for spam bots to send spam email, but not needed for regular users to submit email to their email server) and perhaps some other ports that should never be expected to be used in a home network.

On a typical corporate internet connection the same will be true plus the administrator of the corporate network may have established additional rules.

Such rules help to protect the machines inside the network from much of the types of attack concerned, including attempts from outside attackers to exploit vulnerable software on the inside, as well as the ability for malware within the local network to receive any kind of remote-initiated communications. When it comes to attacks from inside the network, however, that firewall on the boundary is not relevant. If a computer inside the network is compromised, it could conceivably launch attacks throughout the internal network.

This can be mitigated somewhat by other approaches such as monitoring the software loaded onto computers and running virus scanners, and corporate networks tend to do this, in addition to most home users having included virus protection.

A firewall on a local PC can help add just a little more more protection against some kinds of malware, particularly in environments where you have a large number of users on a PC or a large number of people on the same local network.

For example, should you set up the firewall on the local machine to block incoming data that is not part of communications initiated from the local PC itself, a tactic similar to routers at the edge of local networks, you gain that little bit of added protection against attempted network attacks launched from within the local network.

When configuring such a firewall, you will need to add any exceptions for services on ports which need to be able to listen for incoming communication initiated from the outside. Though, you will need to do the same thing at the network router too.

4
  • That was very interesting! However, I'm not sure I know the answer to my first question. Is it then an abuse of language to say that no port is open by default, if no iptables is configured? And what they really meant was that no program is listening on any port, a part from trusted programs? May 4, 2022 at 0:35
  • netfilter does not open or close ports, it is application software that does this. If netfilter is blocking certain traffic from or to a port, an application is still able to "open" the port and even listen on it or transmit from it - it's just that netfilter may block the data packets while in transit, so it may never receive packets and/or packets it sends may never reach a destination. May 4, 2022 at 4:00
  • The default is that it doesn't block any traffic at all - in other words, the default is the most permissive possible policy. May 4, 2022 at 4:00
  • Thank you, it was just me who naively used a wrong definition of open port. May 4, 2022 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .