Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

One of the most common recommendations that I read for users that recently installed Linux Mint is to enable their firewall, which is pretty simple to do. But why is the firewall off by default in the first place? Is there any reason for this?

share|improve this question

2 Answers 2

up vote 7 down vote accepted

Link Mint is an Ubuntu-based distribution intended for desktop systems. One of its chief priorities is "ease of use" so a firewall just puts into play something that could break things for users. It's easier if the firewall only gets turned on if the operator is someone who knows what such a thing even is versus a novice user saying "Why don't it no worky?"

share|improve this answer
3  
Also a lot of connections nowadays are firewalled by routers. –  edvinas.me Apr 25 at 21:36

Linux distributions typically don't have many services (any) running on the external interface and those that do usually require the external access. They systems don't gain significantly from having a firewall.

However, I lock down each of my Linux hosts with a firewall, there are four main purposes.

  • Log hosts scanning services that aren't running;
  • Limit the services that programs can connect to;
  • Segregating the my network into trust segments (LAN, DMZ, and Internet); and
  • Redirecting ports to the hosts providing the service (NAT).

SMTP to and from the Internet is only allowed for my mail server.

If you have a single host only the first two would be of interest. These are also the two that are most likely to cause issues for a beginning user. Some services don't play well with firewalls, and are likely to break if you don't know how to set-up the firewall. Enabling a firewall by default would make using those services very frustrating.

Many services can be protected from outside attack with TCP Wrapper using the hosts.allow and host.deny files. This may be provided by xinetd or built-in to the program. Other programs provide equivalent functionality in their configuration. It is possible to configure both this mechanism and a firewall to provide greater depth of defense.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.