0

I want using reverse proxy (nginx or apache) for my tomcat application. I want redirect the ports 80,443 from reverse proxy to tomcat ports 8080, 8443. After setting up the reverse proxy, which port must be open for inbound & outbound ?

is that right ? iptables inbound : open Port 80, 443 iptables outbound: open Port 8080,8443

kind regards

blackbeard

0

A TCP connection is always between two (not more) participants. Each one is identified with an IP address and a port. So in reality, when you are using a reverse proxy, you have:

  • A connection between the client <client_IP>:<random_port> and nginx <server_public_IP>:80 through you physical interface.
  • A connections between nginx 127.0.0.1:80 and Tomcat 127.0.0.1:8080 through the loopback interface.

There is no reason for a firewall to block communication on the loopback interface. So you probably want to allow incoming traffic with destination port 80 and 443 and outbound traffic with source port 80 and 443.

However, usually, outbound traffic is not blocked (policy ACCEPT), you just need the following iptables rules:

iptables -A INPUT -i lo -j ACCEPT # loopback interface
# don't block existing traffic
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m comment nginx -j ACCEPT
# Probably you want to allow ssh
iptables -A INPUT -p tcp --dport 22 -m comment SSH -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT

PS: You can also run Tomcat directly on ports 80 and 443 with the same firewall rules.

2
  • thx Piotr P. , i wanted only know the open Port .:) but great ;) – beard black Jan 24 '20 at 18:59
  • I believe, it is important to understand, why ports 8080 and 8443 have nothing to do with your problem. If you really want to filter outbound traffic, you should easily find the rules. – Piotr P. Karwasz Jan 24 '20 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.