I have a VM running CentOS with a web server I use for hosting random services I deploy over there, so in order to make it reachable from the Internet I opened port 80 using
iptables. Since the web server itself is running as a service under a dedicated user that is not root, it is not able to use port 80 directly. Thus, after giving the docs a read, I added a redirection from port 80 to 8080 so the web server could be bound to that port (I do plan to add support for HTTPS later, maybe I will buy a proper domain and then use Let's Encrypt or something).
So far it has been working fine, but more recently I have noticed that the port 8080 was left open wide as well, so any requests targeting either port 80 or 8080 would get the same response. The thing is, I need only port 80 to be reachable from outside, because somehow my provider considers leaving the port 8080 open some sort of potential abuse? Either way, I don't want external requests directed to port 8080 to get a response, only those who target port 80 should get any.
So far, this is how my config file for
iptables looks like:
*nat :PREROUTING ACCEPT [89:7936] :INPUT ACCEPT [70:3812] :OUTPUT ACCEPT [41:2756] :POSTROUTING ACCEPT [41:2756] -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 COMMIT *filter :INPUT ACCEPT [916:134290] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [819:117300] :f2b-sshd - [0:0] -A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT
I tried removing the rule that opens the port 8080, but after reloading
iptables the server would not respond to requests from port 80 either. More recently I have been thinking of maybe adding another redirection rule that would change the source IP to something specific to accept in port 8080, but I am not sure if that will work. I need guidance here.
Note: I'm not too experienced with this tool, that is the main source of my doubts. Also, perhaps I'm missing some rules that could be useful, so any suggestions for new rules in the comments below will be appreciated.