I have a service running on port 1339. Is it possible to deny requests from localhost to this port? Currently I have an ufw rule to allow requests from a specified IP but localhost can access the port as well. I don't want users logged in to the server access the url with curl or wget, the port should only be accessible from the specified IP. Is this possible?
2 Answers
I guess it should be possible, with something like this:
ufw deny from 127.0.0.1 to any port 1339
According to the ufw syntax, that's how you block a specific port on an specific IP.
-
You have a protocol parameter missing, the correct command would be
ufw deny from 127.0.0.1 to any port 1339
- but still, this doesn't work. Maybe ufw doesn't affect local traffic. Anyhow, as there are no other answers, by now I'll mark this one as accepted.– AndrisJan 31, 2013 at 10:47 -
@Andris you're right about the parameter missing. Thanks for the correction. Feb 3, 2013 at 15:04
-
1
According what I tried it is not possible using ufw.
The ufw stores user defined rules into separate iptables chain (ufw-user-input for INPUT chain and so on).
Unfortunately if you check the INPUT chain, the ufw-user-input subchain is the last one. The first one is called ufw-before-input and contains the rule that accepts all the localhost communication. Thanks to this the iptables never get to your localhost rule that if defined in ufw-user-input.
At the end I disabled the localhost communication by inserting that rule as a first rule in INPUT chain directly. This can be done by something like:
sudo iptables -I INPUT -p tcp -i lo --dport 5702 -j DROP
This will drop all the packets that goes into TCP port 5702 on localhost.
If you want to check all the chains in iptables, use:
sudo iptables -nvL