Linux iptables: Drop all Apache requests except from a single IP Address

Question

I'm currently building a website using Apache on a Debian 10 Server. I would like to block all traffic to my website except from a single IP Address (my home network's Public IP Address) so that I can build my website without other users accessing the site while I'm building it. I would like to tackle this problem using the server's firewall with iptables. I have created the following rules:

sudo iptables --policy INPUT DROP
sudo iptables --policy OUTPUT DROP
sudo iptables --policy FORWARD DROP

iptables -A INPUT -p tcp -m multiport --dports 80,443 -s 1.2.3.4 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -p tcp -m multiport --sports 80,443 -s 1.2.3.4 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

After a few days of testing I've concluded that the issue must be something with my OUTPUT chain. Any insight or thoughts would be much appreciated, Thank you!!!

UPDATE: Adding the output of iptables-save per request.

Also after even more testing it seems like when I try to access my website via the IP address of the server from a network other than my homework network the request is dropped. Whenever I try to access my website via the domain name the request is not dropped. Could I be missing something with DNS?

Thank you all for the help!

# Generated by xtables-save v1.8.2 on Sun Oct 25 00:48:27 2020
*filter
:INPUT DROP [304:18242]
:FORWARD DROP [0:0]
:OUTPUT DROP [79:6999]
-A INPUT -s 1.2.3.4 -p tcp -m multiport --dports 80,443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -d 1.2.3.4 -p tcp -m multiport --sports 80,443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
COMMIT
# Completed on Sun Oct 25 00:48:27 2020
# Generated by xtables-save v1.8.2 on Sun Oct 25 00:48:27 2020
*nat
:PREROUTING ACCEPT [255:14541]
:INPUT ACCEPT [4:240]
:POSTROUTING ACCEPT [1:67]
:OUTPUT ACCEPT [49:3523]
COMMIT
# Completed on Sun Oct 25 00:48:27 2020
# Generated by xtables-save v1.8.2 on Sun Oct 25 00:48:27 2020
*mangle
:PREROUTING ACCEPT [343:22686]
:INPUT ACCEPT [342:22646]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [102:10858]
:POSTROUTING ACCEPT [53:7350]
COMMIT
# Completed on Sun Oct 25 00:48:27 2020

UPDATE: Can now confirm the issue is I can still access the website via my domain name regardless of my firewall rules

Answer 1

I'll assume that your web server is not part of your home network.

I'll assume that for setting up your web server, you have some type of console access to your web server. I'm making this assumption because you are changing the default policy on all chains (INPUT, OUTPUT, FORWARD) of your iptables filter table to DROP which would cause any remote connection (e.g. ssh) to the web server to fail. In fact you would have broken access to even your loopback interface with that configuration.

I'll assume that when you use 1.2.3.4, you are referring to your home network public IP.

I would ask for clarification via a comment but I don't have enough reputation yet in Server Fault. Feel free to clarify if you like. If my assumptions are correct, then changing "-s" to "-d" in your OUTPUT chain rule might fix the problem. I.e. your web server receives (on INPUT chain) from source (-s source) 1.2.3.4 and your web server sends (on OUTPUT chain) to (-d destination) 1.2.3.4.

Answer 2

The way I usually configure iptables or any firewall is, I do a default drop on the INPUT chain, but leave FORWARD and OUTPUT unchanged. The reasoning is as follows:

INPUT chain limits which "outer packets" are allowed to pass through the firewall. So I stop unwanted packets from coming in at all.

FORWARD chain only works on packets that are marked with forward, like a routing packet. This is valid for NAT or MASQUERADE type packets, which is not usually relevant for Web Server deployments unless you are trying to make this server act as a "router" also. Other than firewall rules, there is another Kernel runtime flag that is set to "0" (disable) by default. You can check this by running:

cat /proc/sys/net/ipv4/ip_forward

OUTPUT chain limits which "inner packets" are allowed to pass through the firewall. So, if you are tinkering with this chain, then you are limiting what packets can "go out". Usually, this is needed if you expect "unauthorized" data to get out of your server. In most cases, that is not relevant and increases the complexity of the firewall.

So, just work with the INPUT chain and avoid touching other chains entirely.

Answer 3

If you can access your website using domain name, then the problem is in your Apache virtual host configuration.

You likely have a virtual host defined for the domain name. This virtual host is used when you access it with a domain name.

When you access the server using IP address, it goes to the default virtual host, which does something else.