2

This question already has an answer here:

I have setup one application 'phanthomjs' that is running of specific port 6423 I wish that it should be accessible to script that are run locally on the box 'localhost', not accessible from outside.

phantomjs--webdriver=6324

my current script make use of TCP and run on same box and we make use server name as localhost for making connection to the application.

Is there any way to in Redhat Linux box to block the access to this port from outside?

marked as duplicate by Wesley, Adam Gibbins, mdpc, HBruijn Dec 28 '15 at 8:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • @hbruijn The "duplicate" question is specifically about using iptables to accomplish a task. This question is about any way to do so, and its two answers do not use iptables. In fact instead of being suffixed "[duplicate]" this question could usefully be suffixed "[without using iptables]". – Law29 Jan 5 '16 at 7:10
2

If your application listens only on localhost, then it cannot be contacted from the outside. If you can configure a "bind" address, then put 127.0.0.1. To check that it works, type lsof -i -n -P :6423 (or 6324 . . .). In the output you should see a line ending with

TCP 127.0.0.1:6423 (LISTEN)

If you see

TCP *:6423 (LISTEN)

then your application is listening on any port, and can thus be contacted from the Internet.

If you cannot make your application listen only on 127.0.0.1, you will need to use iptables.

0

You don't need to block access to the port when binding to localhost: only local processes can access it, other hosts don't have access to it.

To verify that the prices is bound to localhost only and not to the external network interface, run this command:

netstat -ntl | grep 6423

If in the output you see something like 127.0.0.1:6423 then you can be certain that the service is not accessible from other hosts, only by local processes.

If, on the other hand, you see something like *:6423 or an IP address accessible on the network, then the service is accessible, and you need to adjust the configuration to bind to localhost instead.

Not the answer you're looking for? Browse other questions tagged or ask your own question.