Arch Linux

ggg377

Member

Registered: 2015-02-20

Posts: 43

Firewall on a roaming laptop - what do I need?

Hi,

I have googled and wikid this issue for days and I keep finding conflicting information. Some say as Arch has ports closed you don't need a firewall unless you're running a web server or SSH or other similar services (which I do not). Some say if you have a roaming laptop and use free wifi networks, you do need one. While I am privacy and security minded, I don't need a service to block something that's been already blocked "just in case". Would using a firewall such as ufw offer any kind of increased protection on a public network on an Arch system? Do I need a firewall or is it really not that necessary?

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,350

Re: Firewall on a roaming laptop - what do I need?

In my mind, A firewall is not needed on an individual machine.  I generally use them where I want to protect a network segment from outside intrusion.  If the ports on your machine are not open, don't  worry.  If they are open, what is the point of fire walling them?

Also, I have always thought "Software" firewalls running on a machine to keep other software on that same machine in check.  It is like placing the lunatics in charge of the asylum.

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

brebs

Member

Registered: 2007-04-03

Posts: 3,742

Re: Firewall on a roaming laptop - what do I need?

First, check what ports you're listening on:

netstat -tulpn

You'll probably find Xorg listening on port 6000. As a big hint - some previous Xorg security bugs.

R00KIE

Forum Fellow

From: Between a computer and a chair

Registered: 2008-09-14

Posts: 4,734

Re: Firewall on a roaming laptop - what do I need?

@brebs
Not sure that's correct, at least when starting X with 'startx' it runs with '-nolisten tcp', this means no open port.

@ggg377
Regarding the firewall, I'd say don't allow in anything that isn't a reply to something you asked for or something you want in (ex.: ssh).

Some programs will bind to a random port, and even if normally (or if configured) they will not accept anything that doesn't come from the localhost, imho it's better to avoid anything undesirable ever reaching those ports in the first place instead of relying only on the program to be able to handle anything thrown at it.

---

R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K

bleach

Member

Registered: 2013-07-26

Posts: 264

Re: Firewall on a roaming laptop - what do I need?

I find the statefull firewall (arch wiki) good for moving laptops it lets everything out but nothing in unless you specify it for instance a ftp(or vsftp) server to transfer files.

brebs

Member

Registered: 2007-04-03

Posts: 3,742

Re: Firewall on a roaming laptop - what do I need?

when starting X with 'startx' it runs with '-nolisten tcp', this means no open port.

Yeah - Arch hard-codes it.

I don't only consider Arch, though

ggg377

Member

Registered: 2015-02-20

Posts: 43

Re: Firewall on a roaming laptop - what do I need?

Hehe, more conflicting information and opinions from both sides. From the Arch Wiki security guide:

It is highly recommended to install iptables from the official repositories, enable it, and set up some form of firewall.

@bleach I have an idea on how to get the job done, I'm just pondering whether I want to get it done or not. The way I see it right now, the firewall would still mimic Arch's default behavior (what's closed is closed and what's open is open - meaning you're going to make expections in the firewall for the stuff you need anyway as @ewaller mentioned).

By the way the netstat -tulpn output looks like this:

tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::6600                 :::*                    LISTEN      892/mpd             
udp        0      0 0.0.0.0:35271           0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:6694            0.0.0.0:*                           -                   
udp        0      0 127.0.0.1:53            0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:68              0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           -                   
udp6       0      0 :::3189                 :::*     

Doesn't look intriguing to me.