I was considering setting up a software firewall (pf) on my web server and did s

Question

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the non-standard port I'm using for SSH connections.

But seeing as how my server already only has services running on those ports anyway, would it just be pointless? I don't really have a need right now to region-block IPs or anything complex like that.

In simple words that someone with a not-so-complete understanding of IP networking can understand, would it still be useful for me to configure a firewall in this way? How, functionally, is it different from just continuing to not run services on the ports I would block?

Explanation / Answer

In the ideal world, an open port without any services running behind it is the same as a port that is not opened. In the real world, humans make mistakes. The less control you have on a system, the more likely any attack on your system would be amplified by a mistake.

A firewall serves to mitigate your mistake by adding an additional layer of control to your computer system. It does so by accepting, rejecting or dropping connections based on your configuration. As a side effect, it helps to reduce your attackers' ability to fingerprint your operating system (OS) to launch more targeted attacks.

If you are not familiar with your OS, there is a likelihood that you would accidentally re-enable disabled services or start new services that are installed via a system upgrade. Unless you consistently do a check using program such as netstat, these services would be quietly listening for incoming connections without your knowledge. Some of which may, over the course of time, become vulnerable to attacks and provide gap for an attacker to breach your system.

By running a firewall and blocking ports without active services, you are essentially hardening your system by providing redundancy in the event that a security control fails or a vulnerability is exploited during the system's life cycle. This approach is known as defense in depth.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.