0

I'm currently building a website using Apache on a Debian 10 Server. I would like to block all traffic to my website except from a single IP Address (my home network's Public IP Address) so that I can build my website without other users accessing the site while I'm building it. I would like to tackle this problem using the server's firewall with iptables. I have created the following rules:

sudo iptables --policy INPUT DROP
sudo iptables --policy OUTPUT DROP
sudo iptables --policy FORWARD DROP

iptables -A INPUT -p tcp -m multiport --dports 80,443 -s 1.2.3.4 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -p tcp -m multiport --sports 80,443 -s 1.2.3.4 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

After a few days of testing I've concluded that the issue must be something with my OUTPUT chain. Any insight or thoughts would be much appreciated, Thank you!!!

UPDATE: Adding the output of iptables-save per request.

Also after even more testing it seems like when I try to access my website via the IP address of the server from a network other than my homework network the request is dropped. Whenever I try to access my website via the domain name the request is not dropped. Could I be missing something with DNS?

Thank you all for the help!

# Generated by xtables-save v1.8.2 on Sun Oct 25 00:48:27 2020
*filter
:INPUT DROP [304:18242]
:FORWARD DROP [0:0]
:OUTPUT DROP [79:6999]
-A INPUT -s 1.2.3.4 -p tcp -m multiport --dports 80,443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -d 1.2.3.4 -p tcp -m multiport --sports 80,443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
COMMIT
# Completed on Sun Oct 25 00:48:27 2020
# Generated by xtables-save v1.8.2 on Sun Oct 25 00:48:27 2020
*nat
:PREROUTING ACCEPT [255:14541]
:INPUT ACCEPT [4:240]
:POSTROUTING ACCEPT [1:67]
:OUTPUT ACCEPT [49:3523]
COMMIT
# Completed on Sun Oct 25 00:48:27 2020
# Generated by xtables-save v1.8.2 on Sun Oct 25 00:48:27 2020
*mangle
:PREROUTING ACCEPT [343:22686]
:INPUT ACCEPT [342:22646]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [102:10858]
:POSTROUTING ACCEPT [53:7350]
COMMIT
# Completed on Sun Oct 25 00:48:27 2020

UPDATE: Can now confirm the issue is I can still access the website via my domain name regardless of my firewall rules

  • You may have already looked into it and decided against but I think firewalld Is nice to configure. You can also read this article of mine regarding secure remote dev server – The Fool Oct 24 at 2:52
  • Please add output of iptables-save to your question. – Tero Kilkanen Oct 24 at 7:36
  • @TeroKilkanen I have updated the question to include the output of the iptables-save command, thank you! – THExLONExCUBAN Oct 25 at 0:54
  • @TheFool thank you for your interesting article but unfortunately I've decide to stick with iptables. – THExLONExCUBAN Oct 25 at 0:57
  • why is it unfortunate? – The Fool Oct 25 at 1:25
0

I'll assume that your web server is not part of your home network.

I'll assume that for setting up your web server, you have some type of console access to your web server. I'm making this assumption because you are changing the default policy on all chains (INPUT, OUTPUT, FORWARD) of your iptables filter table to DROP which would cause any remote connection (e.g. ssh) to the web server to fail. In fact you would have broken access to even your loopback interface with that configuration.

I'll assume that when you use 1.2.3.4, you are referring to your home network public IP.

I would ask for clarification via a comment but I don't have enough reputation yet in Server Fault. Feel free to clarify if you like. If my assumptions are correct, then changing "-s" to "-d" in your OUTPUT chain rule might fix the problem. I.e. your web server receives (on INPUT chain) from source (-s source) 1.2.3.4 and your web server sends (on OUTPUT chain) to (-d destination) 1.2.3.4.

| improve this answer | |
  • Thank you for your prompt response, all of your assumptions above are correct. I updated my OUTPUT chain per your comment and unfortunately I'm still able to access the website from networks outside of my home networks. The issue is that I'm still able to access the site from any network not just my public IP. – THExLONExCUBAN Oct 24 at 5:11
  • You seem to be using "sudo" to change the policy, but not using sudo for adding the rules. Is there a reason for that? – DericS Oct 24 at 12:46
  • Is it possible that you have other rules in your iptables that are matching and permitting those connections? You can check with something like iptables --list --verbose --numeric --table filter, or use the command iptables-save as suggested above by Tero. – DericS Oct 24 at 18:09
  • I've updated the question to include my recent findings including the output of the iptables-save command. I think the issue has something to do with DNS since request made to the site via the server IP address are failing as they should in different networks but request made via the domain name are working regardless of network. Any thoughts on how that could be possible? – THExLONExCUBAN Oct 25 at 1:00
  • The problem (or part of it) may be unrelated to iptables. You mention that using the IP address (instead of the DNS name) works as expected for other clients (i.e. the other clients can't connect). Can you also confirm that your home client can connect using just the IP address? – DericS Oct 25 at 15:32
0

The way I usually configure iptables or any firewall is, I do a default drop on the INPUT chain, but leave FORWARD and OUTPUT unchanged. The reasoning is as follows:

INPUT chain limits which "outer packets" are allowed to pass through the firewall. So I stop unwanted packets from coming in at all.

FORWARD chain only works on packets that are marked with forward, like a routing packet. This is valid for NAT or MASQUERADE type packets, which is not usually relevant for Web Server deployments unless you are trying to make this server act as a "router" also. Other than firewall rules, there is another Kernel runtime flag that is set to "0" (disable) by default. You can check this by running:

cat /proc/sys/net/ipv4/ip_forward

OUTPUT chain limits which "inner packets" are allowed to pass through the firewall. So, if you are tinkering with this chain, then you are limiting what packets can "go out". Usually, this is needed if you expect "unauthorized" data to get out of your server. In most cases, that is not relevant and increases the complexity of the firewall.

So, just work with the INPUT chain and avoid touching other chains entirely.

| improve this answer | |
0

If you can access your website using domain name, then the problem is in your Apache virtual host configuration.

You likely have a virtual host defined for the domain name. This virtual host is used when you access it with a domain name.

When you access the server using IP address, it goes to the default virtual host, which does something else.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.