dhclient UDP port 68

Question

I've successfully removed or reconfigured the daemons in my server so they will only listen locally. The daemon I have left is dhclient, which listens on UDP port 68. Is it possible for this daemon to only listen locally or does it necessarily have to open UDP port 68 to the world ? (I use network-manager to configure my wired ethernet network automatically.)

Proto Recv-Q Send-Q Local Address  Foreign Address  State PID/Program name
udp        0      0 0.0.0.0:68     0.0.0.0:*              1563/dhclient

Solution 1

As long as you need to use DHCP the DHCP client needs to be able to receive DHCP messages from the network (unless you are running a DHCP server on the same machine).

You can use firewall to filter DHCP traffic if you want but it is a little more complicated.

Solution 2

As long as you've configured the network interface to use DHCP - yes:

A DHCP-request is sendt with 0.0.0.0 as the source address, and the reply is a broadcast-packet as well. It is necessary to expose udp/68 when this occurs.