The problem:
I decided to run linux on hardware, and this involves bringing some games over. I am also trying to use iptables, specifically, as it has been recommended to me for use as a firewall and to get a better grasp of networking concepts. I am using Ubuntu 18.04.5 Bionic Beaver LTS with a custom XFCE4 desktop session handled by lightdm and openbox.
I was examining my system for open ports using the sudo netstat -tulpn | grep LISTEN method.
The output:
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 6741/systemd-resolv .
tcp 0 0 0.0.0.0:27036 0.0.0.0:* LISTEN 28122/steam
tcp 0 0 127.0.0.1:57343 0.0.0.0:* LISTEN 28122/steam
tcp 0 0 127.0.0.1:27060 0.0.0.0:* LISTEN 28122/steam
This would be the standard port useage for playing Star Wars: Knights of the Old Republic 2 on steam. The issue is at the point the game was not running / nor had it been requested to launch by any system I have manually set up (as far as I am aware.)
Investigation:
Entry 1 is, by my understanding, the system-d DNS resolver, listening for DNS related requests on port 53, and of course, the integration for this properly into a standard iptables setup seems to be quite straightforward. I would like to add that, generally, when the command is run, Entry 1 for PID 6741/systemd-resolv is the only entry shown in this list.
However, the other 3 open ports listed are for PID 28122/steam.
And on one occasion, I caught my device in the configuration shown above. I then tried to assess why this was the case, to assess if my IPtables would need changed to permit this operation to happen if it required an active network connection, as I assume it might do, using TCP, dependant on what's going on.
I used my LxTask program to trace down the exact commands being executed by this PID.
For every single port listed, the command being executed was steam steam://rungameid/208580. This would be the command used to launch the only game on the system, an unmodded, clean copy of 'Star Wars: Knights of the Old Republic II'
Why any process, would launch this game but not launch this game, is beyond me. I never tried to launch the game in any fashion and it had been closed for over an hour or more.
The last step I took was to quicky fire an nmap scan at the port 27036, 27060, 57343, to confirm from localhost, it was running on localhost. I used the -sV -sC flags to attempt to extract service information from the TCP/IP stack on the ports.
The command I used for this was: nmap -p 27036,27060,57343 -sV -sC 127.0.0.1 The output:
27036/tcp open ssl/steam Valve Steam In-Home Streaming service
27060/tcp open unknown
57343/tcp open unknown
Following this I would have repeated the same scan from an external network to see if the ports were available outside localhost, but i was unable to find an open connection on the ports specified. When i returned to the subject Ubuntu PC, i double checked to see if the ports were still open using the same sudo netstat -tulpn | grep LISTEN method.
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 6741/systemd-resolv .
It seems the DNS resolver was the only port open in this list.
I repeated the nmap localhost scan from my machine on the previously identified ports. Command used: nmap -p 27036,27060,57343 -sV -sC 127.0.0.1 again. The output:
PORT STATE SERVICE VERSION
27036/tcp closed unknown
27060/tcp closed unknown
57343/tcp closed unknown
It seems that the ports are closed and PID 28122/steam is no longer running on my machine.
Question:
Can anybody explain what this process was I just witnessed with the present information?
Importantly, can you provide me with the context (if relevant), on how steam / general processes that behave weirdly such as this one should be properly handled in the context of iptables rules, as this is what my end goal is to set up.
If possible I'd like an example relevant to this use case of how to deny these ports the right to open, unless I personally launch the game myself.
Possibly Relevant Notes:
My steam package is: steam/bionic,now 1:1.0.0.54+repack-5ubuntu1 i386 [installed]
Built: Jun 8 2021 @ 10:23:41PM
Steam API: v020
Steam Package Version: 1623193086
I have steam client installed with 1 game, Star Wars Knights of the Old Republic 2.
The game is not modded, and is a fresh install.
It requires no network connectivity.
Thanks for your time.
