iptables or firewalld to close all ports except ssh?

Question

I've the following question: How can I close all ports except port 22. nmap shows me all used ports:

nmap localhost

Starting Nmap 7.01 ( https://nmap.org ) at 2017-02-20 20:06 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000050s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 999 closed ports
PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

also netstate displays open connections:

sudo netstat -tulpen | grep -v '127.0.0.1'  | grep -v '::1:'
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          160309215   286/sshd        
tcp6       0      0 :::22                   :::*                    LISTEN      0          160309218   286/sshd  

but these 999 are not really closed they are not in use.

iptables -L gives:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

so every port is open now.

Since this is an external server I have to keep port 22 open, since I use the ssh connection via port 22 during changing the settings.

What might be the best way to configure this?

Can I stop iptables and better start firewalld and make there configurations? Or can I temporarily stop iptables, make changes and then restart iptables?

Or are there some configuration files, that I can edit?

I'm not really familiar with these configurations, but I have to do that carefully and correctly.

Thanks in advance for your help!

Answer 1

For something simple like this I would use ufw. It is installed by default, but let's make sure:

~$ which ufw should return \usr\bin\ufw if ufw is installed. If ufw is not installed: ~$ sudo apt-get install ufw.

The following steps will not take affect until you enable or reload the firewall, so you will not be kicked out.

~$ sudo ufw default deny incoming
~$ sudo ufw default allow outgoing
~$ sudo ufw allow in 22/tcp

You just told the firewall to (a) not let anything in, (b) let everything out, and (c) let tcp in on port 22. To make these rules effective:

~ $ sudo ufw disable
~ $ sudo ufw enable

You will now be warned:

Command may disrupt existing ssh connections. Proceed with operation (y|n)? 

If you are sure you have followed these instructions carefully, answer yes. Finally, let's display the firewall status with sudo ufw status verbose:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
22/tcp (v6)                ALLOW IN    Anywhere (v6) 

Please read the ufw man page for additional information.