Linux

48332 readers

1017 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

Firewalls: what SHOULD I block? (lemmy.wtf)

submitted 1 month ago by [email protected] to c/[email protected]

71 comments fedilink hide all child comments

Hey there folks,

I'm trying to figure out how to configure my UFW, and I'm just not sure where to start. What can I do to see the intetnet traffic from individual apps so I can know what I might want to block? This is just my personal computer and I'm a total newbie to configuring firewalls so I'm just not sure how to go about it. Most online guides seem to assume one already knows what they want to block but I don't even know how/where to monitor local traffic to figure out what I can/should consider blocking.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 1 month ago (2 children)

In a nutshell,

Use wireshark
See if theres any weird connections going on (i.e you visit pancakes.com and wireshark shows unrelatedsite.com making a request as well)
Block unrelatedsite.com

"What about firewalls?"

Block from ports 1000 'till the very end (65565 if I'm not mistaken.) -- that is your "bread and butter" approach.

"W-what if I'm using a port past 1000?"

Nah, you (very likely) aren't and never will.

[–] [email protected] 2 points 1 month ago

Don't listen to this guy at all.

[–] [email protected] 2 points 1 month ago* (last edited 1 month ago)

This is not great advise to say the least. You want to block all incoming but allow all outgoing.

Also visiting a https site will not magically ports. It uses 443/tcp and if you are using a site with WebRTC (used for calls on platforms like teams) ports 443/UDP and 50000-65535/UDP. However, there is no reason you need to know that unless you are in a professional field