I am running an application on port 7000 which is part of a network. So it has to communicate over port 7000 with all other servers of the network (not LAN, dynamic IPs). It has also a web frontend you can access at http://my.ser.ver.ip:7000 but I want to block the access to the webfront end. How is this possible without block my application at all?
If i understood your question correctly, you have multiple ways to block access to your application from outside the server.
- You can set your application to work only with a 127.0.0.1/8 IP address.
- You can block it via iptables.
My best practice is the first option.
You can block this via .htaacess file. In .htaccess fle you need to allow application only via your public IP address and deny all other IP address. Below i have shared the content which needs to be entered in .htaccess file.
Order deny,allow allow from 220.127.116.11 #Your Public IP, only this IP is accessible to application. deny from all
This will sort out the problem for you.
You need to block any access to port 7000, then allow access to port 7000 to only the servers in your network. That way you effectively block the Web UI from being accessed unless you're accessing it from a server inside your network.
HTTP is a protocol (P in HTTP) and runs on port 80. UFW can't block it based on it being a web page or not since it only manages iptables, and only knows it's a web page after a connection has been established.
Depending on which web server you use, you could possible use imvikasmunjal's suggestion. However "block all to access port 7000" and then giving specific access to specific IP's is the best way forward IMO