Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Red Hat-based host running a fairly recent Apache and PHP 5.2, we are using the solr-php-client library to connect to an external Solr server. This library requires the PHP directive allow_url_fopen to be enabled. Therefore, I would like to disable outgoing PHP connections via iptables, other than connections to the necessary server.

Googling for an appropriate iptables rule leads down many wrong paths. What rule would allow PHP to connect via CURL or fopen() to a specific server, but no other?

Thank you.

share|improve this question
up vote 4 down vote accepted

how about using iptables rule that filters not only based on the destination address/port but also based on the source user?

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner uidForYourApacheUser -p tcp --dport 80 -d yourServerIp -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner uidForYourApacheUser -p tcp --dport 80 -j REJECT

if needed you can use su-php to run just your sorl scripts under different uid than your apache.

share|improve this answer
Not sure such rule will prevent php form accessing – user130370 Aug 19 '12 at 17:36
+1 for uid-owner tip – user130370 Aug 19 '12 at 17:37
Thank you! This is a very good base to start googling from for further honing. – dotancohen Aug 19 '12 at 18:08
@Eric DANNIELOU - su-php with separate config/user just for the lucene part + another user for rest of php and proper file system permissions should sort that out. – pQd Aug 19 '12 at 19:14
--dport 80 : You wont prevent http access on other ports like 8080 – user130370 Aug 19 '12 at 20:38

This can't work. You can not disable PHP connections via iptable. iptables is not aware about which process open a connection.

What you might want to do is to disable all outgoing connection except for one destination IP. But you will break any legitimate outgoing trafic.

Tip : One secure setup could be to install a filtering proxy and to disable all traffic except to the proxy, but that's a lot of work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.