Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is it possible that we can block any port to access lets say, 8080 to get blocked from outer-world except our certain ip address? I know how to block the ip address using

listen ...
    ...
    acl bad_ip src XXX.XXX.XXX.XXX #Any Bad IP
    use_backend block_ip if bad_ip
    ...


    backend block_ip
          mode http
          errorfile 403 /etc/haproxy/errors/403.http 

but I am stucked with blocking the port.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Do you need to specifically serve up an http 403? A simple iptables rule would truly block the unwanted traffic.

for example:

iptables -p tcp -m tcp --dport 8080 -s ! $TRUSTED_IP_ADDRESS -j DROP

As for haproxy acl's, you would want the dst_port option, which matches the local port the client is connected to.

acl secure_port  dst_port  8080
acl trusted_ip   src 10.0.0.1
use_backend block_ip if secure_port !trusted_ip

IP tables would be considered the 'right' tool to use, even though haproxy can do the trick.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.