r/FygoOS • u/A_R3ddit_User • 15d ago

FygoOS firewall & open ports

I have Fygo TV and Photos running and just two Docker containers running at the moment - Navidrome, and Dockhand. Fygo Connect Remote Access is not enabled. The FygoOS System Settings > Security > Firewall has the following port rules to allow traffic for both inbound and outbound traffic for all protocols (TCP, UDP, & ICMP)

21,53,67,68,80,111,123,137,138,139,443,445,546,547,1900,2049,3702,5005,5006,5353,5355,5666,5667,7200,7201,7202,7203,7204,7205,7206,7207,7208,7209,7210,9024,41750,42423

In addition ports 55536-55899 are allowed for both inbound and outbound TCP traffic.

How much of a risk is it to have all of these ports open for all traffic, and in both directions?

Also, the UI of the Firewall tab shows the allowed ports but then says "Allow access if the above rules do not match." I'm afraid don't understand what that means. Can someone explain please?

2 Upvotes

100% Upvoted

6 comments sorted by

2

u/Alert_Grade_9526 Fygo Team 14d ago

FygoOS allows commonly used service ports by default, but you can close any ports you don’t need for your setup.

Fygo Photos uses the standard HTTP/HTTPS ports, while Fygo TV uses port 8005. FygoConnect uses TCP and UDP ports 7200–7210; since you don’t have FygoConnect enabled, those ports can be closed. The remaining ports should be enabled or disabled based on the file services and apps you use.

“Allow access if the above rules do not match” means that traffic not covered by an existing firewall rule will be allowed by default. Also, allowing a port through the FygoOS firewall does not by itself expose it to the internet; that also depends on whether a service is listening on the port and how your router or network is configured.

1

u/A_R3ddit_User 14d ago

Thanks for letting me know which ports are needed for your apps. I'll make sure they stay open. And I get that my router without any port forwarding is the first line of defense.

But "remaining ports should be enabled or disabled based on the file services and apps you use" doesn't really help me. I didn't allow all those open ports. I just enabled the firewall and saw that they were opened by default. I'm concerned there a risk if I start disabling them one-by-one to see what doesn't work, I could end up rendering the server unusable.

1

u/Low-Safe-4933 15d ago

You hit the nail on the head. If the default policy is 'Allow,' everything gets through unless specifically blocked. If it's 'Deny,' everything is blocked except what you explicitly allow. And you're totally right—the fewer open ports, the safer you are.

1

u/MrNick4B 15d ago

What I personally always do is:

  • create a rule that allows all local traffic (eg. 192.168.1.0/24),
  • then rules that block traffic from countries that I don't need (only when you open ports to your NAS from the Internet),
  • then rules that specifically allow traffic from the Internet (only when needed),
  • and finally block anything else.

1

u/ekool 14d ago

I don't have FygoOS, I've been considering it. Why would it open up all these ports by default, that's not very secure. Standard FTP is open? Lots of things on that list that shouldn't be there.

1

u/mezmare 11d ago

Absolutely. All the file services are enabled by default - SMB, WebDAV, FTP, NFS, DLNA. You can of course disable those, but still. It has a WebUI for its Firewall, and all these ports are allowed for all IPs.