Block redirected port from external access using ufw

Question

I have an application that uses ftp. I redirected the 21 port to 2221. But I see that 2221 is accessible from external even though it is not specified in ufw rules. So I want to block 2221 from external access as my security scanners reported open port.

I tried many links but not able to get it work, I should be missing the order or something. Can anyone help me on this?

My before.rules file looks like this:

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp --dport 21 -j REDIRECT --to 2221
:OUTPUT ACCEPT [0:0]
COMMIT
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
-A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A ufw-before-input -m state --state INVALID -j DROP
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -i eth0 -s 127.0.0.0/8 -j DROP
-A ufw-before-input -i eth0 -s 224.0.0.0/3 -j DROP
-A ufw-before-input -i eth0 -d 224.0.0.0/3 -j DROP
-A ufw-before-input -i eth0 -d 255.255.255.255 -j DROP
-A ufw-before-input --fragment -p ICMP -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -m limit --limit 2/sec -j ACCEPT
-A ufw-before-input -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A ufw-before-input -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT
-A ufw-before-input -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A ufw-before-input -p tcp -m tcp --dport 8080 -m state --state NEW -j ACCEPT
-A ufw-before-output -m state --state INVALID -j DROP 
-A ufw-before-output -o lo -j ACCEPT 
-A ufw-before-output -o eth0 -j ACCEPT
COMMIT

PS: Adding

-A PREROUTING -p tcp --dport 2221 -j REDIRECT --to 21

does block but I don't want a loop to happen. Also I tried using "-s" and "-i lo" prefix while allowing 2221 which didnt work. Please help.

Answer 1

If you want to simply restrict access to port 21 remove the PREROUTING rule you added:

-A PREROUTING -p tcp --dport 21 -j REDIRECT --to 2221

And remove the rule permitting access to port 21:

-A ufw-before-input -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT

And reload the firewall rules.

If you need to have port 21 open to a specific IP you could change that rule instead of removing it. For example:

-A ufw-before-input -s 123.45.67.8 -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT

Replace 123.45.67.8 with the IP address you need to permit access for.