How Linux Ports and Listening Services Dey Work

Wetin port really be

Port na number wey allow one server run plenty services at the same time without dem network traffic mix up. Your VPS get one IP address, but e fit run web server, SSH server, and database together. When packet enter, operating system need know which service the packet belong to. Port number na the answer. Web traffic dey go port 443, SSH dey go port 22. IP address dey carry packet reach your server; port dey carry am reach the correct program for that server.

Port na 16-bit number: 16 bits give 0 to 65535, and 0 dey reserved, so for practical use ports dey run from 1 to 65535. Ports wey dey below 1024 na the "well-known" ports, and dem need root to open. Na why standard services dey use dem: 22 for SSH, 80 for HTTP, 443 for HTTPS, 53 for DNS. Any port above 1024 ordinary programs fit use.

Two kinds dey: TCP and UDP. Port number for one no connect to the same number for the other. TCP na connection-based protocol wey most services use, like SSH, HTTP, and databases. UDP no dey use connection, and services like DNS and some VPNs dey use am. When you open firewall, you normally specify which one, for example 22/tcp.

Listening mean say program dey wait for connection for port

Program wey wan receive connection dey ask kernel make e “listen” for port. From that moment, port dey open for the machine, and program go answer anything wey arrive there, subject to firewall rules. Port wey no get anything listening go simply refuse connection. So, the first question for any security check na: wetin dey listen, and where.

The command wey go answer that na ss:

sudo ss -tlnp

The flags mean TCP (t), listening sockets only (l), numeric ports (n, so you go see 22 instead of ssh), and the process wey own am (p). Typical result:

State   Recv-Q  Local Address:Port   Process
LISTEN  0       0.0.0.0:22           sshd
LISTEN  0       127.0.0.1:5432       postgres
LISTEN  0       [::]:80              nginx

The Process column tells you which program own each port. Na so you fit track down something wey you no mean to leave running.

The Local Address column na the important part

Read the address wey dey in front of each port carefully, because na e dey decide who fit reach the service. You go see these three cases often.

0.0.0.0:22 mean “listen on every IPv4 address wey this machine get,” including the public one. People fit reach the service from internet over IPv4, if firewall allow am.

[::]:80 mean the same thing for IPv6: listen on every IPv6 address, including public ones. Many programs bind here by default, and for Linux, :: socket often fit accept IPv4 too.

127.0.0.1:5432 mean “listen on loopback only.” 127.0.0.1 na the address wey machine dey use to talk to itself, and nothing outside fit route to am. Service wey bind here fit only be reached from the same server, never from internet, no matter wetin your firewall talk. That Postgres line above safe by design.

The practical rule follow directly from this: database, cache, or admin panel wey na only your own applications dey use suppose bind to 127.0.0.1, not 0.0.0.0. If e never listen on public address, attacker no get anything to reach.

Wey program dey listen no mean say network fit reach am

One more difference go save plenty confusion. If port dey open for the machine, meaning say program dey listen, e different from whether outside fit reach that port, meaning say firewall allow am. Both must happen before remote client fit connect. The two failures even dey look different from client side: if connection dey refused, nothing dey listen; but if connection hang then time out, e usually mean say firewall drop the packet. Na exactly wetin those two SSH errors dey tell you.

So control dey for two layers. You decide wetin go listen by setting each service bind address. You also decide wetin people for outside fit reach with firewall. Server wey dem dey manage well dey use both: services bind only for places wey dem need, and firewall deny everything wey you no explicitly allow. To read wetin dey listen with ss na step one; to decide wetin firewall permit na step two. firewalls 101 with UFW cover this second step.

One small detail fit cause problem here. IPv4 and IPv6 dey separate, and firewall wey only cover IPv4 go leave the [::] services open for IPv6. This particular trap get im own post: the IPv6 firewall trap.

FAQ

How I fit see which ports dey open for my Linux server?

Run sudo ss -tlnp for TCP or sudo ss -ulnp for UDP. E go list every listening socket, the port, the local address wey e bind to, and the process wey own am. Check the Local Address column: 0.0.0.0 or [::] mean say the service dey exposed to the network, while 127.0.0.1 mean say e dey listen only for the machine itself.

Wetin be the difference between 0.0.0.0 and 127.0.0.1?

0.0.0.0 mean say “listen on all IPv4 addresses,” including the public one, so the service fit reach from the network. 127.0.0.1 na loopback, the address wey the machine dey use to talk to itself, and nothing from outside fit route to am. So service wey bind to am fit reach only locally. Bind internal services to 127.0.0.1 so dem no go ever expose.

I need open port for firewall before service fit work?

Na only services wey other machines need reach. Service wey bind to 127.0.0.1 no need firewall rule because nothing external fit reach am anyway. Service for 0.0.0.0 or [::] need firewall rule to allow the traffic, and you suppose deny am by default until you add one.

Wetin be the difference between TCP port and UDP port?

TCP dey use connection and most services dey use am, like SSH, web servers, and databases. UDP no dey use connection and DNS plus some VPNs dey use am. The same number for TCP and UDP na separate ports, so 53/tcp and 53/udp different. When you write firewall rules, name the protocol, for example 22/tcp.