7

Let's say as the example that I have a firewall that blocks ALL ports from all sources/destinations.

What ports would I need to open to be able to successfully run:

ping google.com

...and are there any other ports I would have to open to be able to browse google.com via a browser?

I've tried opening port 53(dns) 80(http) and 443(https); this is not enough, I am using iptables but I am not asking for how to configure this on iptables, I'm just asking which ports need to be open regardless of what port based firewall you may be using.

7

For DNS, you need to allow UDP packets between any port on an IP address inside the firewall, and port 53 on an IP address outside the firewall.

For HTTPS, you need to allow TCP packets between any port on an IP address inside the firewall, and port 443 outside the firewall, or more rarely any port outside the firewall (some websites are not on the default port). For HTTP, it's the same with port 80.

TCP is a connected protocol; the two ends of the connection are not symmetric and firewalls usually make a difference between. There's rarely any security reason to prevent outgoing connections except maybe to force outgoing email to go through a dedicated relay (to prevent infected machines from sending spam undetected). A typical basic firewall for a client machine allows all or most outgoing connections, and blocks incoming connections.

For ping, allow ICMP. You should allow all ICMP unless you have a specific reason to block certain kinds of packets. Blocking ICMP indiscriminately can make network problems hard to diagnose and can cause floods due to applications not getting proper error replies.

Here's a simple Linux firewall configuration suitable for a typical client machine, that allows everything outdoing except SMTP to a machine other than smtp.example.com and blocks incoming TCP connections except on port 22 (SSH).

iptables -F INPUT
# Accept everything on localhost
iptables -A INPUT -i lo -j ACCEPT
# Accept incoming packets on existing connections
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Accept DNS replies
iptables -A INPUT -p udp --sport 53 -j ACCEPT
# Accept incoming SSH connections
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Reject everything else that's incoming
iptables -A INPUT -j REJECT
iptables -F OUTPUT
# Forbid outgoing SMTP except to a known relay
iptables -A OUTPUT -p tcp --dport 22 ! -host smtp.example.com -j REJECT
# Allow everything else that's outgoing
iptables -P OUTPUT -j ALLOW
  • These ports alone aren't actually working for me (nice iptables config though). Nevermind SSH (that ones nice and simple, I already have that set up) as you said I allowed all ICMP for ping. And thanks to this I can now ping my DNS server directly. However ping google.com does not work with this configuration. The config is (Accept all ICMP, Accept 53 UDP, accept 80 TCP and accept 443 TCP) – Cestarian Apr 16 '16 at 23:41
  • @Cestarian What's failing: the DNS request, or the ping? What is your firewall configuration? Your description is too imprecise (you need to distinguish between input and output rules, and between source and destination port numbers). – Gilles Apr 16 '16 at 23:43
  • I think it's the DNS request that fails (I can ping googles direct IP address) and oh, my firewall actually has all outgoing ports, these are the in ports I was referring to, besides the ports I mentioned in my earlier comment, consider all incoming traffic to be blocked but all outgoing traffic to be accepted. Btw as a test, I tried opening all tcp ports and all udp ports individually, the ping google.com fails when either all TCP or all UDP ports (besides the ones previously mentioned) are blocked so it's safe to assume more than 1 port is missing. – Cestarian Apr 16 '16 at 23:46
  • @Cestarian What's your DNS configuration? Are you getting DNS in an unusual way (i.e. anything other than UDP to port 53)? – Gilles Apr 16 '16 at 23:50
  • I've got my DNS configured on the router (OpenDNS). It is delivered to the system via dhcp. I decided to try unblocking all traffic coming directly from the router, and this seems to solve my issue. Do you know any means I can use to find out which ports are being used? – Cestarian Apr 16 '16 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.