Ports & Protocols

Common protocols + their default ports:

Port ranges:

• 0-1023: well-known (require root to bind on Unix).
• 1024-49151: registered.
• 49152-65535: dynamic / ephemeral (clients use for outbound).

Common policies:

• Block ALL by default; whitelist exceptions.
• Allow outbound: most stacks allow OUT freely; restrict IN.
• No incoming SSH from public; require VPN first.
• Egress filter: only allow specific outbound (HTTP, HTTPS, DNS).

Sample iptables rules:

# Allow established connections (return traffic)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from internal
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT

# Allow HTTP/HTTPS from anywhere
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Drop everything else
iptables -A INPUT -j DROP

ICMP:

• Ping (echo request/reply): often blocked or rate-limited.
• Path MTU discovery: needed; allow.
• ICMP type 3 code 4 (frag needed): MUST allow.

UDP-specific:

• No "established" state (stateless protocol). Conntrack tracks anyway based on flow tuple + timeout.

TCP flags:

• SYN: connection request.
• ACK: acknowledge.
• FIN: clean close.
• RST: abort.
• Filter: drop SYN-only packets to closed ports.