dnf ports

[MikeBerger]

To help set my iptables: Does dnf use tcp or udp? What are the port numbers?

Thanks,
Mike.

[vallimar]

So far as I know, DNF works over the standard http protocol.

[MikeBerger]

When I restricted INPUT to --sport 80, and also enable DNS, it didn't work.

Mike.

[alphacrucis]

You allow tcp 80 as the destination port in the OUTPUT chain and for INPUT use stateful, you just allow incoming ESTABLISHED, RELATED:

INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

[vallimar]

It might be using https these days, do you allow 443?

[MikeBerger]

WireShark and restrictive iptables settings inform me that it uses 443, 53, 21, and ephemeral ports. An odd combination IMHO.

Mike.

[vallimar]

Not very odd at all. Those are FTP, HTTPS and domain lookup ports.
Perfectly standard internet stuff.

[MikeBerger]

Yes, but HTTPS is high security, while FTP is lowest security. How does this make sense?

[vallimar]

HTTPS is middlin' security at best. And I'm guessing it's because the developers
jumped on the HTTPS everywhere bandwagon that was (is?) popular. If you want
a real explanation though, this isn't the place to ask. http://dnf.baseurl.org/

[DaWeed]

I am wondering the same things because I am facing timeout with DNF.
I don't allow all packet to go out with my iptables.
When I launch an update with dnf , I see drop in the iptables log.
Then it works few sec later because it must use ftp ou http, protocol that I allowed.
I see tcp out to 39086 , 32054 etc

How can we prevent this ?
I didn't find anything for the moment.

$netstat -tup
tcp 0 1 myhost:57472 excellent.ircam.f:39086 SYN_SENT 15081/python3
tcp 0 0 myhost:45086 excellent.ircam.fr:ftp ESTABLISHED 15081/python3
tcp 0 1 myhost:46394 excellent.ircam.fr:32054 SYN_SENT 15081/python3

# dig +short excellent.ircam.fr
129.102.1.37

janv. 25 19:09:26 myhost kernel: [DROP]: IN= OUT=enp3s0 SRC=192.168.0.254 DST=129.102.1.37 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31126 DF PROTO=TCP SPT=46394 DPT=32054 WINDOW=29200 RES=0x00 SYN URGP=0
janv. 25 19:09:26 myhost kernel: [DROP]: IN= OUT=enp3s0 SRC=192.168.0.254 DST=129.102.1.37 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=11880 DF PROTO=TCP SPT=57472 DPT=39086 WINDOW=29200 RES=0x00 SYN URGP=0

[DaWeed]

it seems that I am not alone !

https://bugzilla.redhat.com/show_bug.cgi?id=1229050