# [SOLVED] Dynamic closing/opening of ports in iptables?

## Rexilion

hey,

I was wondering the following.

A looooong time ago I found out what UPNP does, I turned it off since running a firewall with UPNP is (in my opinion) rather useless. From there on, I decided to open a range of ports (like three for each computer) and use those ports for any servers (like torrent, gtk-gnutella etc etc) that needed it. 

However, I was wondering, is it possible to 'reserve' a port in iptables but then to keep it closed. And then only to really open it when a program starts to listen on that port. Something allong the lines of:

iptables -A INPUT -m whenused -p tcp --dport 6881 -j ACCEPT

Is this crazy/paranoid/good/bad? But is it also possible?Last edited by Rexilion on Thu Mar 18, 2010 5:06 pm; edited 1 time in total

----------

## Rexilion

Found it (should have looked better), I can use the socket match extension for this   :Very Happy:   Was this a known question or did no one know?   :Laughing: 

----------

## Inodoro_Pereyra

Interesting, I didn´t know. How do you acomplish that?

Cheers!

----------

## Rexilion

Well,  I haven't used it yet. But it should work like:

```
# For example, take our favorite p2p protocol (torrent) and let's do it only for tcp for now:

iptables -P INPUT DROP

iptables -A INPUT -p tcp --dport 6881 -m socket -j ACCEPT
```

What happens here, we have 2 situations:

- Bittorrent is not running -> no socket at port 6881 -> -m socket does *not match* -> any incoming packets that target port 6881 are being DROPped (INPUT chain policy)

- Bittorrent is running -> socket at port 6881 -> -m socket *matches* -> any incoming packets that target port 6881 are being ACCEPTed (rule policy)

So what happens here? Your are *stealth* (everything being dropped) if you don't have any servers running that listen at 6881. Whenever you start a server, a port somewhat 'automatically' opens (in iptables you 'reserve' it for later use actually).

As I said, I reserve like 3 ports for these kind of things since I don't use UPNP. What happens it that these 3 ports always 'respond' with an answer, even if there is *no* server running behind them (which is useless actually). With this, you don't get a response when you don't have actually anything running behind these ports.

However, there are a few limitations:

- You need at least kernel 2.6.33 to use this in the INPUT chain (however, the patch is really simple so you can easily backport it)

According to the following site: http://carnivore.it/2009/11/22/iptables_-_match_closed_ports:

 *Quote:*   

> current limitations
> 
> Testing the socket match, I've had some problems
> 
>     *
> ...

 

The last limitation might be annoying, but I think I can work around all of that.

----------

## Inodoro_Pereyra

Thank you for taking the time to explain this! It is a really useful feature.

I will take a deeper look, thanks again.

Cheers!

----------

## Rexilion

No problem  :Smile:  . Altough I might think that the INADDR_ANY might be a showstopper for me...

```
Alpha ~ # netstat -lnp

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address        Foreign Address          State       PID/Program name    

tcp        0      0 0.0.0.0:             0.0.0.0:*               LISTEN      3352/smbd           

tcp        0      0 0.0.0.0:            0.0.0.0:*               LISTEN      3717/vino-server    

tcp        0      0 0.0.0.0:           0.0.0.0:*               LISTEN      3416/sshd           

tcp        0      0 127.0.0.1:          0.0.0.0:*               LISTEN      3196/hddtemp        

tcp        0      0 0.0.0.0:           0.0.0.0:*               LISTEN      4582/transmission   

tcp        0      0 0.0.0.0:             0.0.0.0:*               LISTEN      2997/cupsd          

tcp        0      0 0.0.0.0:             0.0.0.0:*               LISTEN      3352/smbd           

udp        0      0 0.0.0.0:           0.0.0.0:*                           3544/openvpn        

udp        0      0 0.0.0.0:           0.0.0.0:*                           4582/transmission   
```

 :Laughing: 

----------

