0

I'm trying to block a maximum of connection to my server as it needs to be accessible only from me and a website. Then I added that to iptables:

*filter

-A INPUT -s my.own.ip/32 -j ACCEPT
-A INPUT -s the.other.site.ip/32 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -j ACCEPT
-P INPUT DROP

COMMIT

But curl (through php) is no more able to access some urls. What's wrong with that rules ?

  • The proper loopback address is 127.0.0.0/8 – kubanczyk Apr 3 '18 at 18:29
  • Add -A INPUT -j LOG so everything goes to log before being dropped. – kubanczyk Apr 3 '18 at 18:31
  • Did you know that "php" can be seen as "that.other.ip" when you connect to it, but a totally different IP when it connects back to you? You need to verify that. – kubanczyk Apr 3 '18 at 18:33
0

But curl (through php) is no more able to access some urls

Your rules are dropping all incoming that traffic that isn't my.own.ip or the.other.site.ip. So yes, if you are expecting to have PHP connect to something that is not these two IP's, you won't get very far. You will have to add specific statements for each IP that you want allowed.

  • Or maybe allow all outbound ? – Entretoize Apr 3 '18 at 18:34
  • Given that you've only added rules to the INPUT table, then it stands to assume that the OUTBOUND table is empty; an empty table means nothing is dropped, therefor you already have an allow all outbound. But if you're blocking INPUT based on source-ip, then if the source IP is NOT one of the configured ones in your list, it's getting dropped. – Andrew Apr 3 '18 at 18:36
  • For me if I block only inbound, then outbound must work so curl must also, this is what I don't understand, can't I tell that connection initiated from server will work ? – Entretoize Apr 3 '18 at 18:55
  • TCP connections are two-way connections. You can't block only input and expect output to work as well. If you send a packet to 1.2.3.4, then 1.2.3.4 is going to send a response. If you allow outbound, that means the packet to 1.2.3.4 will leave your system, but if you're blocking everything inbound, then when 1.2.3.4 sends it's response, it's getting dropped since it's not in the allowed list. – Andrew Apr 3 '18 at 18:57
  • You might want to look at some basic concepts of how a firewall operates. You've indicated a lack of knowledge in this category: computer.howstuffworks.com/firewall1.htm – Andrew Apr 3 '18 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.