Ports and egress blocking

Port scan detection#

The agent sees every incoming TCP connection attempt, to open and closed ports alike, through a read-only filter in the kernel. A port scan is:

• one address touching 15 different ports within 10 minutes, or
• one network (a /24 in IPv4, a /64 in IPv6) touching 30 different ports from 3 or more addresses within 10 minutes.

Detect port scans is on by default and reports a port_scan warning. Ban port scanners is off by default, because monitoring services and search engines scan too; when on, it bans single addresses, never whole networks.

Closing a port#

Databases and admin services should not face the internet. Closing a port drops new connections to it from public addresses; loopback, private networks and whitelisted addresses keep access, and so do programs on the server itself. It covers ports published by Docker containers, and IPv6 too when ip6tables is available.

Only these ports can be closed: 3306, 5432, 6379, 6380, 27017, 27018, 9200, 9300, 11211, 2375, 2376, 5984, 8086, 15672, 5601, 9042, 7000, 7001, 8529 and 28015 (MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch, Memcached, the Docker API, CouchDB, InfluxDB, RabbitMQ, Kibana, Cassandra, ArangoDB, RethinkDB).

Never closed: 22, 80, 443, any port SSH listens on or an open SSH session uses, and any port a web server listens on. A port is not closed while a public address is connected to it.

Blocking outbound traffic#

A destination can be blocked only if the agent itself flagged it as a threat in the last 24 hours: a connection to a listed address, a DNS answer pointing to one, or an entry of the enforced threat list. Never blocked: private, protected and whitelisted addresses, the dashboard, the configured DNS servers, an address logged in over SSH right now or that an SSH login came from in the last 30 days, or an address connected to a service of the server right now. A connection to SSH that has not logged in, such as a brute force, protects nobody. Outbound blocks apply to IPv4.

Regular destinations#

The agent counts the server's own outbound connections per address and day: public IPv4 addresses and a daily count only, kept for 7 days. An address is a regular destination when, the first time it matched a threat list, the server had connected to it 5 or more times on 3 or more of the 7 days before. An API, a backup service or an update mirror that ends up on a threat list must not be cut off by an automatic decision, so blocking a regular destination needs a person: Apply by an owner or admin with two-factor authentication, or an approval on Approvals. The match says how many connections on how many days. A block already in force stays. An address that was already listed when the server first reached it never becomes regular (agent 1.0.35 or later).

A match also says its direction. inbound means the listed address connected to a service of the server: it is an attacker, not a destination, and AutoMode bans it instead of blocking traffic to it.

Who asks for it#

Ports are closed and destinations blocked when a person asks from the dashboard, or when AutoMode or the emergency mode decide to. Every change appears in Activity, with Undo. Nothing changes in monitor mode.

AutoMode and the emergency mode close a port by themselves only when it is one of 3306, 5432, 6379, 27017, 9200, 11211, 2375, 2376, 5984 and 8086, the hardening check found it open to the network, and it was attacked in the last 24 hours (agent 1.0.31 or later, which reports its SSH ports). Any other port needs your approval: MySQL's 3306 with no attack on it, PostgreSQL's 5432 or RabbitMQ's 15672 wait on Approvals. AutoMode and the emergency mode block a destination by themselves only after a critical match of an outbound connection, and never a regular destination.

Approving a port needs two-factor authentication. Only an owner or admin signed in with two-factor authentication can approve closing a port, or close it at once with Apply on the security score; without 2FA, that Apply becomes a request on Approvals too. Turn it on under Settings › Security.

Verified, or undone#

Before each change the agent notes which SSH ports and sites answer; after it, it checks them again. If something stopped answering, it undoes the change by itself and reports Rolled back.

The rules live in the agent's chains INFRAFENCE-PORTS and INFRAFENCE-EGRESS, and are restored after a restart. Limits: 200 closed ports and 1,000 blocked destinations per server.