5

I have installed the gufw firewall utility and want to make a whitelist of ports (want maximum security, but whitelisting single IPs is currently too tedious). I have so far only entered ports 53 (for DNS), 80 (for HTTP) and 443 (for HTTPS), both in- and outgoing, into the whitelist and closed the firewall, but Ubuntu Software Center can install programs without hindrance, whereas the firewall definitely is running (www content won't load when list entries are not present).

Is it using any of these ports for program data transfer? Seems strange to me. Or is there an overriding exception pre-defined in Ubuntu (this is a new setup, 12.04)? What is probably the case here, and what port does the Software Center use for program data (I assume it does use HTTP for the interface and list entries, but the programs themselves?)?

TLDR:

  1. Why does Ubuntu Software Center get through my firewall which blocks all but DNS/HTTP/HTTPS (via blocking all other ports), so that it can install programs?

  2. Which port does it use for the program data transfer?

  • I doubt USC uses any port... – Xerz Feb 1 '13 at 14:58
  • Doesn't it technically have to use a port if it transfers data via network? – DeadCommunist Feb 1 '13 at 15:09
  • @espectalll123 It will definitely use ports for outgoing traffic, but it doesn't need any to listen on (incoming traffic). DeadCommunist: no need to open up ports for incoming traffic in your firewall. Can you inspect the kernel messages in /var/log/syslog to see if there's traffic being blocked? – gertvdijk Feb 1 '13 at 15:21
  • There are a number of what seem to be outgoing transmissions, all to the same IP, which have been blocked since firewall activation. I do not know what caused them, and as I said the Software Center was able to make an install during the firewall activity. – DeadCommunist Feb 1 '13 at 15:26
4

Here's what I found out by running Wireshark while installing a single application using the Ubuntu Software Centre:

  • DNS requests (outgoing to UDP port 53 to your configured DNS server, for...) and HTTP (outgoing to TCP port 80 to...)
    • reviews.ubuntu.com
    • myapps.developer.ubuntu.com
    • software-center.ubuntu.com
  • Everything about your local APT configuration (repositories configured). This is usually either HTTP or FTP and requires DNS as well of course. See your "Software Sources" to see what Ubuntu archives mirror you're using. If you can run sudo apt-get update without errors, you're all set.

Note: I did not find any HTTPS traffic. However, this may be the case for private PPAs (used for commercial software).

  • apt-get update seems to work without problems, but does that mean that the Sotfware Center / apt uses only DNS and HTTP (ports 53 and 80 respectively, or 443 for HTTPS) for transfer, or does it mean that it somehow gets past the firewall even though it blocks anything else? (Isn't HTTP only (meant/suitable for use) for Web page content transfer, not bulk data/repo lists/programs/etc?) (sorry for not being well informed) – DeadCommunist Feb 1 '13 at 15:39
  • @DeadCommunist HTTP is used very broadly for downloading large amounts of data. When you've obtained the Ubuntu ISO file, you've probably used HTTP as well. :) And no, APT cannot go beyond the firewall, but it may be configured to use a proxy server. In that case, it will do the exact same thing in Software Centre for the fetching packages part. I'm not sure about the other content being downloaded (reviews, icons, etc.). – gertvdijk Feb 1 '13 at 15:48
  • Oh yes of course, most of the common downloads triggered via web pages are via HTTP I guess, what else... So it uses DNS and HTTP (ports 53/80) and perhaps FTP, and I also learned that no exceptions for incoming are required in the firewall except when the other side, desiredly, initiates the contact. The question is thus to be considered solved, thanks. – DeadCommunist Feb 1 '13 at 15:51
0

If you block everything except ssh and run apt-get update it will return both the IPs and ports:

Err:2 http://archive.canonical.com/ubuntu xenial InRelease
      Could not connect to archive.canonical.com:80 (91.189.92.191). - connect (111: Connection refused) [IP: 91.189.92.191 80]
    Err:3 http://us-east1.gce.archive.ubuntu.com/ubuntu xenial InRelease
      Could not connect to us-east1.gce.archive.ubuntu.com:80 (35.196.129.83). - connect (111: Connection refused) [IP: 35.196.129.83 80]
    Err:4 http://us-east1.gce.archive.ubuntu.com/ubuntu xenial-updates InRelease
      Unable to connect to us-east1.gce.archive.ubuntu.com:http: [IP: 35.196.129.83 80]
    Err:5 http://us-east1.gce.archive.ubuntu.com/ubuntu xenial-backports InRelease
      Unable to connect to us-east1.gce.archive.ubuntu.com:http: [IP: 35.196.129.83 80]
    Err:6 http://security.ubuntu.com/ubuntu xenial-security InRelease
      Could not connect to security.ubuntu.com:80 (91.189.88.162). - connect (111: Connection refused) [IP: 91.189.88.162 80]
    Reading package lists...

Maybe better if you test on a real console and not a remote terminal. Unplug the LAN cable and run apt update then check the errors returned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.