4

Is this the right way to block all outgoing ports? : ufw default deny outgoing

But what are the consequences of doing this on amazon ec2?

I'm running possibly unsafe perl scripts on my instance and I don't any of them to reach the internet.

4
  • 1
    ALL outgoing ports? Including the one you are using to reach the server? – Hennes Feb 19 '13 at 17:43
  • Yea that's what. I'm pretty stupid when it comes to these things :/ and I don't know what damage it will cause. Essentially I don't want any perl scripts I execute to call the internet. – gideon Feb 19 '13 at 17:45
  • @Hennes Ok I updated my question. – gideon Feb 19 '13 at 17:47
  • 2
    Without knowing what you want to do on that server it might be relative harmless. But closing everything including your own access to the server is a traditional mistake. A rather educative one. Whatever you do, make sure you configure things so you can get back in, either via some other way, or via a script which undos things unless cancelled. (e.g. script undo in 10 minutes & Test changes, if it works: great. If not wait 10 minutes until access is restored) – Hennes Feb 19 '13 at 17:48
3

But what are the consequences of doing this on amazon ec2?

Everything breaks.
At least everything that uses the network in any way, shape, or form. If no outbound connections can be made, and no provisions are made for getting back in / handling "established" connections.

If you want to secure your system with a firewall you should:

  1. Allow inbound connections to specific ports/services you use
  2. (Generally) allow outbound connections from your server to anywhere.
    (Alternately) allow outbound connections from your server to specific hosts and ports that you know provide services you use.
  3. Ensure the rules in (1) and (2) allow "established" (or "related") traffic.
  4. Deny everything else.
2
  • Good amazon specific answer. – Hennes Feb 19 '13 at 17:50
  • well it's the general answer too - If you remove the words "virtual" or "Amazon EC2" from the question the answer is usually the same :-) – voretaq7 Feb 19 '13 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.