I have a service running on port 1339. Is it possible to deny requests from localhost to this port? Currently I have an ufw rule to allow requests from a specified IP but localhost can access the port as well. I don't want users logged in to the server access the url with curl or wget, the port should only be accessible from the specified IP. Is this possible?
I guess it should be possible, with something like this:
ufw deny from 127.0.0.1 to any port 1339
According to the ufw syntax, that's how you block a specific port on an specific IP.
According what I tried it is not possible using ufw.
The ufw stores user defined rules into separate iptables chain (ufw-user-input for INPUT chain and so on).
Unfortunately if you check the INPUT chain, the ufw-user-input subchain is the last one. The first one is called ufw-before-input and contains the rule that accepts all the localhost communication. Thanks to this the iptables never get to your localhost rule that if defined in ufw-user-input.
At the end I disabled the localhost communication by inserting that rule as a first rule in INPUT chain directly. This can be done by something like:
sudo iptables -I INPUT -p tcp -i lo --dport 5702 -j DROP
This will drop all the packets that goes into TCP port 5702 on localhost.
If you want to check all the chains in iptables, use:
sudo iptables -nvL