Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is it possible that we can block any port to access lets say, 8080 to get blocked from outer-world except our certain ip address? I know how to block the ip address using

listen ...
    acl bad_ip src XXX.XXX.XXX.XXX #Any Bad IP
    use_backend block_ip if bad_ip

    backend block_ip
          mode http
          errorfile 403 /etc/haproxy/errors/403.http 

but I am stucked with blocking the port.

share|improve this question
up vote 3 down vote accepted

Do you need to specifically serve up an http 403? A simple iptables rule would truly block the unwanted traffic.

for example:

iptables -p tcp -m tcp --dport 8080 -s ! $TRUSTED_IP_ADDRESS -j DROP

As for haproxy acl's, you would want the dst_port option, which matches the local port the client is connected to.

acl secure_port  dst_port  8080
acl trusted_ip   src
use_backend block_ip if secure_port !trusted_ip

IP tables would be considered the 'right' tool to use, even though haproxy can do the trick.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.