When I try to telnet to a port on a server, and if there is no program listening on that port telnet dies with a "Unable to connect ... " error. I understand that. But, why do we need a firewall if there is no program listening on any ports?


4 Answers 4


There may not be a service running right now, but how about tomorrow? You have them all turned off, but what about your users? Anyone on a unix/windows/mac system can open a port > 1024 on any machine they have access to. What about malware? What about a virus? They can also open up ports and start serving information to the world, or start listening for connections from the network.

A firewall's main purpose is not to block the ports for services you know are disabled, it is to block the ports on services you might not know about. Think of it as a default deny with only certain holes punched in for services you authorize. Any user or program started by a user can start a server on a system they have access to, a firewall prevents someone else from connecting to that service.

A good admin knows what services need to be exposed, and can enable them. A firewall is mostly to mitigate the risk from unknown servers running on your system or your network, as well as to manage what is allowed into the network from a central place.

It's important to know what is running on your machine/server and only enable what you need, but a firewall provides that extra bit of protection against the things you don't know about.

  • 1
    > "Any user or program started by a user can start a server on a system they have access to, a firewall prevents someone else from connecting to that service." But, wouldn't this make the service unusable? Feb 1, 2012 at 18:03
  • 6
    @KhajaMinhajuddin yes! That's exactly the point. (-:
    – gabe.
    Feb 1, 2012 at 18:08
  • 2
    @KhajaMinhajuddin You only want services that you setup to be available to the world. You don't want the smtp server that super_spam_virus.exe started while you weren't looking listening for connections from other infected systems. A firewall will prevent this, though it's not a panacea.
    – gabe.
    Feb 1, 2012 at 18:09
  • super_spam_virus.exe doesn't sound like Unix & Linux :) Feb 2, 2012 at 12:41
  • @userunknown true... how about a.out, or a compromised version of /bin/ls that was copied to your system. Or, if you're a developer hg serve which starts a webserver on your machine. Point is, it's trivial to start a server on any machine whether it's used as a 'desktop' or a 'server' doesn't matter. And once that server is started, and you don't know about it... well, that's when the fun starts.
    – gabe.
    Feb 2, 2012 at 16:53

IF there is no program listening on any port, you don't need a firewall, but you also can't connect to your server because it is 'sealed' from the rest of the world.

On the other hand ... let's say your server does not have any locally running program listening on any port, but it serves as a gateway for other computers behind it. In this case you use a firewall to manage the masquerading (NAT) and optionally you can filter some stuff on packet forwarding.

  • This is a good point, but if I want the server to do stuff( I usually would put openssh and a webserver). Even with a firewall, I have to open ports to make the running apps like openssh and webservers useful. So, I guess what I am asking is, Are there any programs which open up ports to the outside world which need to be blocked by a firewall and which would still be useful. Feb 1, 2012 at 17:59
  • 1
    Yes there are. Not necessary an example for a server, but let's presume you have a Linux machine with X installed, and X running on a network port. You would want to allow your computer, maybe some other computers from the LAN to connect to your X. However you would not want Joe from France to connect to it. Another example, let's say you set up multiple VPN services on your server and you need to control which networks can see other networks (or not to see). Or, let's say you have OpenSSH but you want to allow connection only from your home computer. There are many other examples. Feb 1, 2012 at 18:28
  • 1
    @KhajaMinhajuddin: For ssh, you should use the /etc/ssh/sshd_config to secure the machine. PermitRootLogin should be set to No, you should use a secure password and maintain the machine with sudo (you may use sudo after logging in with an account with sudo permissions). Setting the restrictions with a firewall is just the wrong tool for the job. The same would be true for a postgresql database: Use the database configuration, to set and revoke permissions. Feb 2, 2012 at 19:52

Strictly speaking it may not be necessary, however, keep in mind that a firewall can provide more functionality than simply refusing connections over network ports. For example, DROP versus REJECT behavior.

  • 1
    What is the advantage of DROP versus REJECT? Feb 2, 2012 at 12:42
  • I'm not sure, but I believe DROP just doesn't respond so the requester doesn't even know if the request was received or if your machine exists. REJECT says you're definitely there and just don't want to talk about it. And, if something's behind a locked door, it might be worth trying to find a way in to find out what's worth protecting.
    – Joe
    Feb 4, 2012 at 0:00

But, why do we need a firewall if there is no program listening on any ports?

If you have a Single-User Desktop, not a server, you don't need a firewall, if there is no service running, as on a default Ubuntu installation.

Windows had some times, after being able to do networking, some services running on default for maintenance, updates, internal message passing and so on. You couldn't stop them, without stopping windows working, but they where vulnerable for external attacks. So the windows users needed a firewall, and the meme, that everybody needs a firewall, spread fast.

When they met the Linux folks, which often were server admins, they didn't say 'you don't need a firewall on linux' but 'we have free firewalls like iptables for nearly a decade'.

A personal firewall, sitting on the system it shall protect, isn't the best idea either.

On a single user desktop system, you don't need a personal firewall.

  • 3
    Look at the answer from gabe and rethink. Especially the Desktop clients are vulnerable to attacks.
    – Nils
    Feb 1, 2012 at 21:29
  • 1
    @userunknown: a virus might be a user of your desktop. A daemon that you install and fail to configure is too. Feb 2, 2012 at 1:59
  • 1
    I have run security testing for many years, and access through desktops is a very useful route to propagate an attack. Doesn't matter if it's Windows, Linux, Solaris, whatever. Lock it down or lose it to an attacker. The correct phrase should be you may need a firewall on your desktop - fully assess the risks in your environment
    – Rory Alsop
    Feb 2, 2012 at 12:11
  • 2
    @userunknown just because you use a computer as a desktop doesn't mean it's not still a server those are just words. Your desktop has plenty of servers that could potentially run on it, and possibly that already are.
    – gabe.
    Feb 2, 2012 at 16:58
  • 1
    Think about CUPS (any linux), SLPD (SuSE) and other stuff (KDE-remote, iSCSI-server/client) that may be running on linux after an update. Even if you checked before these things may appear. If they do it is good to block them. BTW - activate your firewall via GUI (dont allow anything) on RedHat, start CUPS and see if you can connect to it from outside. Then look at iptables-save`: Voila - the CUPS port is open without showing up in the gui...
    – Nils
    Feb 2, 2012 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.