Blocking the port using Haproxy

Question

is it possible that we can block any port to access lets say, 8080 to get blocked from outer-world except our certain ip address? I know how to block the ip address using

listen ...
    ...
    acl bad_ip src XXX.XXX.XXX.XXX #Any Bad IP
    use_backend block_ip if bad_ip
    ...


    backend block_ip
          mode http
          errorfile 403 /etc/haproxy/errors/403.http 

but I am stucked with blocking the port.

Answer 1

Do you need to specifically serve up an http 403? A simple iptables rule would truly block the unwanted traffic.

for example:

iptables -p tcp -m tcp --dport 8080 -s ! $TRUSTED_IP_ADDRESS -j DROP

As for haproxy acl's, you would want the dst_port option, which matches the local port the client is connected to.

acl secure_port  dst_port  8080
acl trusted_ip   src 10.0.0.1
use backend block_ip if secure_port !trusted_ip