0

I have a server with a docker and a UFW firewall (I know it might have conflit because docker open some port despite UFW rules) but:

When I telnet this server from outside on a random closed port, Telnet stay in "Trying..." instead of sending a "Refused connection"

If I go to the server and do the same with telnet 127.0.0.1 7777 I have the "Refused connection"

Any idea ?

2 Answers 2

2

Many firewalls will "stealth" a port rather than actually "close" it. What this means is, rather than affirmatively sending back a "Connection Refused", it will instead waste the client's time making it think it will get a response back before its own timeout. In this way, the thinking goes, a potential attacker's port scan is less utile because it's impossible to tell which ports are actually closed and which may simply have slow or currently-nonresponsive services behind them. It also means a crafty attacker can't make the target waste its time sending a ton of "sorry, we're closed" packets in lieu of nothing at all.

2
  • Ho really interesting! I asked this question because i am testing a repository proxy and i want to know what would happened if I cut it. Actually when the application try do download jar from this (down) proxy it get stuck for a (very very ) long time before try the no-proxy repo.
    – Benjamin
    Oct 4, 2018 at 21:31
  • So I just have to allow this port in UFW for the case of my docker (which open its port alone) will be stopped Thanks @DopeGhoti
    – Benjamin
    Oct 4, 2018 at 21:41
0

Although the most used firewall rules are allow and deny, there is usually another choice available, often called reject. UFW also has it.

The difference between "deny" and "reject" is that while "deny" makes the firewall completely ignore that a packet was received, "reject" makes the firewall always send the appropriate "sorry, we're closed" on behalf of the actual recipient, whether or not there is any service actually listening for incoming connections or not.

Most operating systems, and definitely any even half-decent firewalls, will always give a very low priority to the task of sending the "sorry, we're closed" packets anyway - so if the system has anything even slightly more important things to do, those packets will get delayed or outright omitted, firewall or no firewall.

So, if you want to block something in a firewall and yet need any connection attempts to that port to fail fast with a clear "connection refused" error, use a reject rule in your firewall rather than the default deny.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.