3

I have a service running on port 1339. Is it possible to deny requests from localhost to this port? Currently I have an ufw rule to allow requests from a specified IP but localhost can access the port as well. I don't want users logged in to the server access the url with curl or wget, the port should only be accessible from the specified IP. Is this possible?

2 Answers 2

1

I guess it should be possible, with something like this:

ufw deny from 127.0.0.1 to any port 1339

According to the ufw syntax, that's how you block a specific port on an specific IP.

3
  • You have a protocol parameter missing, the correct command would be ufw deny from 127.0.0.1 to any port 1339 - but still, this doesn't work. Maybe ufw doesn't affect local traffic. Anyhow, as there are no other answers, by now I'll mark this one as accepted.
    – Andris
    Jan 31, 2013 at 10:47
  • @Andris you're right about the parameter missing. Thanks for the correction. Feb 3, 2013 at 15:04
  • 1
    Accepted wrong answer? Bruh
    – ExposedCat
    Dec 5, 2022 at 17:06
5

According what I tried it is not possible using ufw.

The ufw stores user defined rules into separate iptables chain (ufw-user-input for INPUT chain and so on).

Unfortunately if you check the INPUT chain, the ufw-user-input subchain is the last one. The first one is called ufw-before-input and contains the rule that accepts all the localhost communication. Thanks to this the iptables never get to your localhost rule that if defined in ufw-user-input.

At the end I disabled the localhost communication by inserting that rule as a first rule in INPUT chain directly. This can be done by something like:

sudo iptables  -I INPUT -p tcp -i lo --dport 5702 -j DROP

This will drop all the packets that goes into TCP port 5702 on localhost.

If you want to check all the chains in iptables, use:

sudo iptables -nvL

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .