1. Overview
Indeed, every application employs ports to interact with other devices across the network. With TCP and UDP as the two primary transport protocols, we need ports to transmit/receive data over the networks. All operating systems require this logical entity for effective communication. Whenever we start the application services, they automatically get mapped to the available network ports.
However, the ports are closed by default in many operating systems. That’s why we have to open network ports at the base operating system to enable the communication flow from the base to the remote system.
This article explains how to open a network port in Linux.
2. What Is a Network Port?
Fundamentally, every host machine can run several applications within the system. If an application has to communicate with other devices, it uses the network interface with the host-associated IP address. However, if two or more applications running on the same machine, then the associated port helps to distinguish the traffic for that specific application from the network interface. When we say that a port is open or listening, it means that the application or process is ready to accept traffic.
3. iptables
iptables is the default firewall software that Linux systems use to filter network packets. It uses the Netfilter framework to implement the IP packet filter rules that manage the incoming and outgoing packets. Basically, it revolves around the concept of tables and chains.
A chain is a set of rules for processing the packets, and a table is a collection of chains used to perform a specific function. Here, the filter examines the packets against the rules and routes them accordingly. It’s always a good practice to enable packet filters to improve the application and system security.
Next, let’s list the firewall rules using the iptables command:
$ sudo iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Here, the output shows that by default, all the input traffic gets blocked. As a result, any packet reaching the server from the other devices gets dropped.
In general, the application of rules is temporary and, upon system restart, gets removed. To avoid this occurrence, let’s save the iptables rules using the iptables-save command:
$ /sbin/iptables-save
4. Opening the Network Port
For the sake of discussion, let’s take the below example:
Here, we have a web application hosted on port 8080 in the Linux Machine. The firewall software in the Linux system monitors the incoming and outgoing traffic. However, based on the user-defined firewall rules, it filters the network packets. Even though the web application is running successfully within the system, exposing it to the outside world depends on the firewall rules.
Let’s deploy a simple nodejs application on the server that runs on port 8080:
$ npm start
> [email protected] start /home/tools/baeldung-iptables/node-hello
> node index.js
Server running on http://192.168.56.109:8080/
..
..
We deployed the application successfully, and it’s accessible on the machine as we can verify using the curl command:
$ curl https://localhost:8080/
Hello Node!
Now, let’s open http://192.168.56.109:8080 from the browser. Though the “nodejs” application is running with no exception, the site is not opening from the browser:
Here, the issue arises because of the packet filter deployment in the server. As per the below illustration, the server drops the request at the interface:
To overcome this problem, we have to create a rule in the iptable that allows all the web traffic coming into the server at port 8080:
$ sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
In this case, we are appending a rule into the INPUT chain to ACCEPT any TCP packets with the destination port of 8080:
Now, let’s refresh the browser page and check:
Likewise, let’s look at a few more examples of blocking incoming network connections.
To block all incoming TELNET connections to the server, we add the below rule into the INPUT chain:
$ sudo iptables -I INPUT -p tcp --dport 23 -j DROP
If we want to block any incoming web traffic connections to the server from a specific IP address, we can do so by adding a similar rule into the INPUT chain:
$ sudo iptables -I INPUT -p tcp --dport 80 -s 192.168.56.109 -j DROP
5. Conclusion
In summary, network ports are essential for applications to interact with other devices. The enablement of iptables in the server is critical in enriching its security constructs as it helps to manage the application traffic over the network. As a best practice, the rules need to be tailored using iptables based on our applications’ needs.