2002-11-09 19:06:34 +01:00
|
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<html>
|
|
|
|
|
|
<head>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<meta http-equiv="Content-Type"
|
|
|
|
|
|
content="text/html; charset=windows-1252">
|
|
|
|
|
|
<title>Shorewall Port Information</title>
|
|
|
|
|
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
|
|
|
|
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
2002-08-13 22:45:21 +02:00
|
|
|
|
</head>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<body>
|
|
|
|
|
|
<h1 style="text-align: center;">Ports Required for Various
|
|
|
|
|
|
Services/Applications<br>
|
|
|
|
|
|
</h1>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<p>In addition to those applications described in <a
|
2003-12-03 00:51:46 +01:00
|
|
|
|
href="Documentation.htm">the /etc/shorewall/rules documentation</a>,
|
|
|
|
|
|
here are some other services/applications that you may need to
|
|
|
|
|
|
configure
|
|
|
|
|
|
your firewall to accommodate.</p>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>NTP (Network Time Protocol)</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2003-02-28 03:12:52 +01:00
|
|
|
|
<p>UDP Port 123</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<p>rdate</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2003-02-28 03:12:52 +01:00
|
|
|
|
<p>TCP Port 37</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<p>UseNet (NNTP)</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>TCP Port 119</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>DNS</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p>UDP Port 53. If you are configuring a DNS client, you will
|
|
|
|
|
|
probably
|
|
|
|
|
|
want to open TCP Port 53 as well.<br>
|
|
|
|
|
|
If you are configuring a server, only open TCP Port 53 if
|
|
|
|
|
|
you will return long replies to queries or if you need to enable ZONE
|
|
|
|
|
|
transfers. In the latter case, be sure that your server is
|
|
|
|
|
|
properly
|
2003-08-09 19:14:58 +02:00
|
|
|
|
configured.</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
<p>ICQ </p>
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p>UDP Port 4000. You will also need to open a range of TCP ports
|
|
|
|
|
|
which you can specify to your ICQ client. By default, clients use
|
|
|
|
|
|
4000-4100.</p>
|
|
|
|
|
|
</blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>PPTP</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<p><u>Protocol</u> 47 (NOT <u>port</u> 47) and TCP Port 1723 (<a
|
2003-12-03 00:51:46 +01:00
|
|
|
|
href="PPTP.htm">Lots more information here</a>).</p>
|
|
|
|
|
|
</blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>IPSEC</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p><u>Protocols</u> 50 and 51 (NOT <u>ports</u> 50 and 51) and UDP
|
|
|
|
|
|
Port 500. These should be opened in both directions (Lots more
|
|
|
|
|
|
information <a href="IPSEC.htm">here</a> and <a href="VPN.htm">here</a>).</p>
|
|
|
|
|
|
</blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<p>SMTP (Email)</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p> TCP Port 25.</p>
|
|
|
|
|
|
</blockquote>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p>RealPlayer<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</p>
|
|
|
|
|
|
<blockquote>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p>UDP Port 6790 inbound<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</p>
|
|
|
|
|
|
</blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<p>POP3</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<p>TCP Port 110 (Secure = TCP Port 995)<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</p>
|
|
|
|
|
|
</blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<p>IMAP<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</p>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<blockquote>TCP Port 143 (Secure = TCP Port 993)<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>TELNET</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>TCP Port 23.</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>SSH</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>TCP Port 22.</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>Auth (identd)</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>TCP Port 113</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<p>Web Access</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2003-02-28 03:12:52 +01:00
|
|
|
|
<p>TCP Ports 80 and 443.</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
2003-08-09 19:14:58 +02:00
|
|
|
|
<p>FTP<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</p>
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p>TCP port 21 plus <a href="FTP.html">look here for much more
|
|
|
|
|
|
information</a>.<br>
|
2003-08-09 19:14:58 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
</blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<p>SMB/NMB (Samba/Windows Browsing/File Sharing)</p>
|
|
|
|
|
|
<blockquote> </blockquote>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2002-08-13 22:45:21 +02:00
|
|
|
|
<p>TCP Ports 137, 139 and 445.<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
UDP Ports 137-139.<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Also, <a href="samba.htm">see this page</a>.</p>
|
|
|
|
|
|
</blockquote>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
<p>Traceroute</p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
|
<p>UDP ports 33434 through 33434+<i><max number of hops></i>-1<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
ICMP type 8 ('ping')<br>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</blockquote>
|
2003-02-08 21:46:02 +01:00
|
|
|
|
<p>NFS<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</p>
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p>I personally use the following rules for opening access from zone
|
|
|
|
|
|
z1 to a server with IP address a.b.c.d in zone z2:<br>
|
|
|
|
|
|
</p>
|
2003-02-28 03:12:52 +01:00
|
|
|
|
<pre>ACCEPT z1 z2:a.b.c.d udp 111<br>ACCEPT z1 z2:a.b.c.d tcp 111<br>ACCEPT z1 z2:a.b.c.d udp 2049<br>ACCEPT z1 z2:a.b.c.d udp 32700:<br></pre>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
|
<p>Note that my rules only cover NFS using UDP (the normal case).
|
|
|
|
|
|
There is lots of additional information at <a
|
|
|
|
|
|
href="http://nfs.sourceforge.net/nfs-howto/security.html">
|
|
|
|
|
|
http://nfs.sourceforge.net/nfs-howto/security.html</a></p>
|
|
|
|
|
|
</blockquote>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p>VNC<br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</p>
|
|
|
|
|
|
<blockquote>
|
2003-05-15 21:39:23 +02:00
|
|
|
|
<p>TCP port 5900 + <display number></p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
</blockquote>
|
|
|
|
|
|
<p>Didn't find what you are looking for -- have you looked in your own
|
|
|
|
|
|
/etc/services file? </p>
|
|
|
|
|
|
<p>Still looking? Try <a
|
|
|
|
|
|
href="http://www.networkice.com/advice/Exploits/Ports">
|
|
|
|
|
|
http://www.networkice.com/advice/Exploits/Ports</a></p>
|
2003-08-09 19:14:58 +02:00
|
|
|
|
<p><font size="2">Last updated 7/30/2003 - </font><font size="2"> <a
|
2002-11-09 19:06:34 +01:00
|
|
|
|
href="support.htm">Tom Eastep</a></font> </p>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<a href="copyright.htm"><font size="2">Copyright</font> <20>
|
2003-08-09 19:14:58 +02:00
|
|
|
|
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
2003-12-03 00:51:46 +01:00
|
|
|
|
<br>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<br>
|
2002-11-09 19:06:34 +01:00
|
|
|
|
</body>
|
|
|
|
|
|
</html>
|
