2004-02-14 19:06:39 +01:00
<?xml version="1.0" encoding="UTF-8"?>
< !DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<article >
<articleinfo >
<title > Ports Required for Various Services/Applications</title>
<authorgroup >
<author >
<firstname > Tom</firstname>
<surname > Eastep</surname>
</author>
</authorgroup>
2004-05-29 17:12:25 +02:00
<pubdate > 2004-05-28</pubdate>
2004-02-14 19:06:39 +01:00
<copyright >
<year > 2001-2002</year>
<year > 2004</year>
<holder > Thomas M. Eastep</holder>
</copyright>
<legalnotice >
<para > Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
<quote > <ulink url= "GnuCopyright.htm" > GNU Free Documentation License</ulink> </quote> .</para>
</legalnotice>
<abstract >
<para > In addition to those applications described in the
/etc/shorewall/rules documentation, here are some other
services/applications that you may need to configure your firewall to
accommodate.</para>
</abstract>
</articleinfo>
2004-04-05 23:13:45 +02:00
<section >
<title > Important Notes</title>
<note >
<para > Beginning with Shorewall 2.0.0, the Shorewall distribution
contains a library of user-defined actions that allow for easily
allowing or blocking a particular application. Check your
2004-05-29 17:12:25 +02:00
<filename > /usr/share/shorewall/actions.std</filename> file for a list of
the actions in your distribution. If you find what you need, you simply
use the action in a rule. For example, to allow DNS queries from the
2004-04-05 23:13:45 +02:00
<emphasis role= "bold" > dmz</emphasis> zone to the <emphasis role= "bold" > net</emphasis>
zone:</para>
<programlisting > #ACTION SOURCE DESTINATION
AllowDNS dmz net</programlisting>
</note>
<note >
<para > In the rules that are shown in this document, the ACTION is shown
as ACCEPT. You may need to use DNAT (see <ulink url= "FAQ.htm#faq30" > FAQ
30</ulink> ) or you may want DROP or REJECT if you are trying to block
the application.</para>
<para > Example: You want to port forward FTP from the net to your server
at 192.168.1.4 in your DMZ. The FTP section below gives you:</para>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
2004-02-14 19:06:39 +01:00
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 21</programlisting>
2004-04-05 23:13:45 +02:00
<para > You would code your rule as follows:</para>
2004-02-14 19:06:39 +01:00
2004-04-05 23:13:45 +02:00
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
2004-02-14 19:06:39 +01:00
DNAT net dmz:192.168.1.4 tcp 21</programlisting>
2004-04-05 23:13:45 +02:00
</note>
</section>
2004-02-14 19:06:39 +01:00
<section >
<title > Auth (identd)</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 113</programlisting>
</section>
<section >
<title > DNS</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 53
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 53</programlisting>
2004-05-29 17:12:25 +02:00
<para > Note that if you are setting up a DNS server that supports recursive
resolution, the server is the < <emphasis > destination</emphasis> >
for resolution requests (from clients) and is also the < <emphasis > source</emphasis> >
of recursive resolution requests (usually to other servers in the
' net' zone). So for example, if you have a public DNS server in
your DMZ that supports recursive resolution for local clients then you
would need:</para>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT all dmz udp 53
ACCEPT all dmz tcp 53
ACCEPT dmz net udp 53
ACCEPT dmz net tcp 53</programlisting>
<note >
<para > Recursive Resolution means that if the server itself can' t
resolve the name presented to it, the server will attempt to resolve the
name with the help of other servers. </para>
</note>
2004-02-14 19:06:39 +01:00
</section>
<section >
<title > FTP</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 21</programlisting>
<para > Look <ulink url= "FTP.html" > here</ulink> for much more information.</para>
</section>
<section >
2004-05-09 00:31:54 +02:00
<title > ICQ/AIM</title>
2004-02-14 19:06:39 +01:00
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
2004-05-09 00:31:54 +02:00
ACCEPT <emphasis > < source> </emphasis> net tcp 5190</programlisting>
2004-02-14 19:06:39 +01:00
</section>
<section >
<title > IMAP</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 143 #Unsecure IMAP
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 993 #Secure IMAP</programlisting>
</section>
<section >
<title > IPSEC</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> 50
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> 51
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 500
ACCEPT <emphasis > < destination> </emphasis> <emphasis > < source> </emphasis> 50
ACCEPT <emphasis > < destination> </emphasis> <emphasis > < source> </emphasis> 51
ACCEPT <emphasis > < destination> </emphasis> <emphasis > < source> </emphasis> udp 500</programlisting>
<para > Lots more information <ulink url= "IPSEC.htm" > here</ulink> and <ulink
url="VPN.htm">here</ulink> .</para>
</section>
<section >
<title > NFS</title>
2004-03-17 16:03:46 +01:00
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < z1> </emphasis> :< list of client IPs> <emphasis > < z2> </emphasis> :a.b.c.d tcp 111
ACCEPT <emphasis > < z1> </emphasis> :< list of client IPs> <emphasis > < z2> </emphasis> :a.b.c.d udp</programlisting>
2004-02-14 19:06:39 +01:00
</section>
<section >
<title > NTP (Network Time Protocol)</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 123</programlisting>
</section>
<section >
<title > <trademark > PCAnywhere</trademark> </title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 5632
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 5631</programlisting>
</section>
<section >
<title > Pop3</title>
<para > TCP Port 110 (Secure Pop3 is TCP Port 995)</para>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 110 #Unsecure Pop3
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 995 #Secure Pop3</programlisting>
</section>
<section >
<title > PPTP</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> 47
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 1723</programlisting>
<para > Lots more information <ulink url= "PPTP.htm" > here</ulink> and <ulink
url="VPN.htm">here</ulink> .</para>
</section>
<section >
<title > rdate</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 37</programlisting>
</section>
<section >
<title > SSH</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 22</programlisting>
</section>
<section >
<title > SMB/NMB (Samba/Windows Browsing/File Sharing)</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 137,139,445
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 137:139
ACCEPT <emphasis > < destination> </emphasis> <emphasis > < source> </emphasis> tcp 137,139,445
ACCEPT <emphasis > < destination> </emphasis> <emphasis > < source> </emphasis> udp 137:139</programlisting>
<para > Also, see <ulink url= "samba.htm" > this page</ulink> .</para>
</section>
<section >
<title > SMTP</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
2004-05-09 00:31:54 +02:00
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 25 #Insecure SMTP
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 465 #SMTP over SSL (TLS)</programlisting>
</section>
<section >
<title > SNMP</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 161:162
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 161</programlisting>
2004-02-14 19:06:39 +01:00
</section>
<section >
<title > Telnet</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 23</programlisting>
</section>
2004-05-14 00:07:06 +02:00
<section >
<title > TFTP</title>
<para > You must have TFTP connection tracking support in your kernel. If
modularized, the modules are <emphasis role= "bold" > ip_conntrack_tftp</emphasis>
(and <emphasis role= "bold" > ip_nat_tftp</emphasis> if any form of NAT is
involved) These modules may be loaded using entries in
<filename > /etc/shorewall/modules</filename> . The <emphasis role= "bold" > ip_conntrack_tftp</emphasis>
module must be loaded first. Note that the <filename > /etc/shorewall/modules</filename>
file released with recent Shorewall versions contains entries for these
modules.</para>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 69</programlisting>
</section>
2004-02-14 19:06:39 +01:00
<section >
<title > Traceroute</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> udp 33434:33443 #Good for 10 hops
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> icmp 8</programlisting>
<para > UDP traceroute uses ports 33434 through 33434+< max number of
hops> -1</para>
</section>
<section >
<title > Usenet (NNTP)</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 119</programlisting>
<para > TCP Port 119</para>
</section>
<section >
<title > VNC</title>
<para > Vncviewer to Vncserver -- TCP port 5900 + < display number> .</para>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 5901 #Display Number 1
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 5902 #Display Number 2
...</programlisting>
<para > Vncserver to Vncviewer in listen mode -- TCP port 5500.</para>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 5500</programlisting>
</section>
<section >
<title > Web Access</title>
<programlisting > #ACTION SOURCE DESTINATION PROTO DEST PORT(S)
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 80 #Insecure HTTP
ACCEPT <emphasis > < source> </emphasis> <emphasis > < destination> </emphasis> tcp 443 #Secure HTTP</programlisting>
</section>
<section >
<title > Other Source of Port Information</title>
<para > Didn' t find what you are looking for -- have you looked in your
own /etc/services file?</para>
<para > Still looking? Try <ulink
url="http://www.networkice.com/advice/Exploits/Ports">http://www.networkice.com/advice/Exploits/Ports</ulink> </para>
</section>
<appendix >
<title > Revision History</title>
2004-05-29 17:12:25 +02:00
<para > <revhistory > <revision > <revnumber > 1.11</revnumber> <date > 2004-05-28</date> <authorinitials > TE</authorinitials> <revremark > Corrected
directory for actions.std and enhanced the DNS section.</revremark> </revision> <revision > <revnumber > 1.10</revnumber> <date > 2004-05-09</date> <authorinitials > TE</authorinitials> <revremark > Added
2004-05-14 00:07:06 +02:00
TFTP.</revremark> </revision> <revision > <revnumber > 1.9</revnumber> <date > 2004-04-24</date> <authorinitials > TE</authorinitials> <revremark > Revised
2004-05-09 00:31:54 +02:00
ICQ/AIM.</revremark> </revision> <revision > <revnumber > 1.8</revnumber> <date > 2004-04-23</date> <authorinitials > TE</authorinitials> <revremark > Added
SNMP.</revremark> </revision> <revision > <revnumber > 1.7</revnumber> <date > 2004-02-18</date> <authorinitials > TE</authorinitials> <revremark > Make
2004-03-17 16:03:46 +01:00
NFS work for everyone.</revremark> </revision> <revision > <revnumber > 1.6</revnumber> <date > 2004-02-14</date> <authorinitials > TE</authorinitials> <revremark > Add
2004-02-14 19:06:39 +01:00
PCAnywhere.</revremark> </revision> <revision > <revnumber > 1.5</revnumber> <date > 2004-02-05</date> <authorinitials > TE</authorinitials> <revremark > Added
information about VNC viewers in listen mode.</revremark> </revision> <revision > <revnumber > 1.4</revnumber> <date > 2004-01-26</date> <authorinitials > TE</authorinitials> <revremark > Correct
ICQ.</revremark> </revision> <revision > <revnumber > 1.3</revnumber> <date > 2004-01-04</date> <authorinitials > TE</authorinitials> <revremark > Alphabetize</revremark> </revision> <revision > <revnumber > 1.2</revnumber> <date > 2004-01-03</date> <authorinitials > TE</authorinitials> <revremark > Add
rules file entries.</revremark> </revision> <revision > <revnumber > 1.1</revnumber> <date > 2002-07-30</date> <authorinitials > TE</authorinitials> <revremark > Initial
version converted to Docbook XML</revremark> </revision> </revhistory> </para>
</appendix>
</article>
