Restrict Apache web server to local users

Jason.nix · 12-22-2023, 02:03 PM

Hello,
I have an Apache web server running on port 443. This web server is located in an internal network and has two IP addresses. An internal IP address and an Internet IP address. I don't want anyone over the internet to be able to see the apache web server and only users within the network can connect to the web server. How can I do this through iptables?

Thank you.

Turbocapitalist · 12-22-2023, 02:20 PM

You can use Apache2 itself for that. See:

https://httpd.apache.org/docs/2.4/howto/access.html

https://httpd.apache.org/docs/curren...e.html#require

Specify the network rather than an individual IP address.

Code:

  ...
  <Location "/">
    ...
    <RequireAll>
        Require ip 192.168.1.0/24
    </RequireAll>
  </Location>
  ...

IsaacKuo · 12-22-2023, 02:21 PM

Usually you don't need to do anything. It depends on how you're connecting with the outside internet. But usually, it will be through some sort of router, and by default the router will simply ignore incoming requests on ports 443 or 80 or whatever.

Basically, most routers will, by default, only react to incoming IP packets that are associated with previous outgoing requests. For example, if one of your internal computers sends out an HTTPS request on port 443 of google.com, the returning answer will be forwarded to that internal computer. But if it receives a packet that isn't paired with an outgoing request that it understands, the router will simply have no idea what computer to forward it to. So it just ignores it.

Most routers can be configured to forward incoming requests to a particular port to a particular internal IP address. This is useful if you WANT to run an externally accessible server. But this is something that you'll have to explicitly configure, and the way to accomplish this will depend highly on your specific router.

michaelk · 12-22-2023, 02:30 PM

You can also configure apache to only listen to a specific address and port regardless of the firewall rules. Exact howto depends if you are using virtualhosts. Without details of how your rules are setup just add a rule to drop port 80/443 traffic on the internet interface / IP address.

frankbell · 12-22-2023, 08:08 PM

Close incoming port 443 in your router. In fact, any incoming ports that you don't have a positive need for should be closed.

Use the /etc/hosts file to tell your local computers where to find the server.

wpeckham · 12-22-2023, 09:13 PM

No need to mess with the router, just have it listen ONLY on the internal interface and the internet can never find it.

Jason.nix · 12-27-2023, 12:11 PM

Quote:

Originally Posted by frankbell

Close incoming port 443 in your router. In fact, any incoming ports that you don't have a positive need for should be closed.

Use the /etc/hosts file to tell your local computers where to find the server.

Hello,
Thank you so much for your reply.
Can you show me an example of the hosts file?

Jason.nix · 12-27-2023, 12:11 PM

Quote:

Originally Posted by wpeckham

No need to mess with the router, just have it listen ONLY on the internal interface and the internet can never find it.

Hello,
Thank you so much for your reply.
How?

michaelk · 12-27-2023, 12:18 PM

https://httpd.apache.org/docs/2.4/bi...l%20interfaces.

wpeckham · 12-27-2023, 06:26 PM

Quote:

Originally Posted by Jason.nix

Hello,
Thank you so much for your reply.
How?

When you configure a web server you configure it to listen on one interface, all interfaces, one IP address, or all IP addresses.
If you have not, the documentation is available at apache.org I believe. Look up the "Listen" directive in the configuration file information.

Jason.nix · 12-30-2023, 12:52 AM

Hello,
Thank you so much for all replies.
How can I do it with iptables? For example, I only want users with IP addresses in the range of 192.168.1.1/24 to be able to connect to the web server.

Turbocapitalist · 12-30-2023, 02:34 AM

IPTables? As mentioned in the other thread, the development for that has wound down, there is a long tail though. I expect that iptables rules might be something like the following (untested), but it would vary 100% depending on what you already have there:

Code:

iptables -I INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 80 \
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

iptables -I INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 443 \
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Just to be clear, the above depends 100% on what you have or don't have in place already and will either work as-is, or lock you out, or something in between.

NFTables would be as follows, a variation the other thread.

Code:

#!/usr/sbin/nft -f

# Clear all prior state
flush ruleset

# Basic IPv4/IPv6 stateful firewall 
table inet filter {

	chain input {
		type filter hook input priority 0; policy drop;

		# accept local host traffic
		iifname "lo" ip saddr 127.0.0.0/8 ip daddr 127.0.0.0/8 \
		counter accept
		iifname "lo" ip6 saddr ::1 ip6 daddr ::1 \
		counter accept

		#  Accept traffic originated from us
		ct state { established, related } accept

		# Drop invalid connections
		ct state invalid drop

		# Reject AUTH to make it fail fast
		tcp dport 113 reject with icmpx type port-unreachable

		tcp dport   22 ct state new limit rate 4/minute counter accept

		# adjust these as needed
		iifname "eth0" ip daddr 192.168.1.0/24 tcp dport 80 \
		ct state new counter accept
		iifname "eth0" ip daddr 192.168.1.0/24 tcp dport 443 \
		ct state new counter accept

		# ICMPv4
		# Accept ICMP
		ip protocol icmp icmp type {
			echo-reply,  # type 0
			destination-unreachable,  # type 3
			echo-request,  # type 8
			time-exceeded,  # type 11
			parameter-problem,  # type 12
		} accept

		# ICMPv6
		# Accept basic IPv6 functionality
		ip6 nexthdr icmpv6 icmpv6 type {
			destination-unreachable,  # type 1
			packet-too-big,  # type 2
			time-exceeded,  # type 3
			parameter-problem,  # type 4
			echo-request,  # type 128
			echo-reply,  # type 129
		} accept

		#  Allow IPv6 SLAAC
		ip6 nexthdr icmpv6 icmpv6 type {
			nd-router-solicit,  # type 133
			nd-router-advert,  # type 134
			nd-neighbor-solicit,  # type 135
			nd-neighbor-advert,  # type 136
		} ip6 hoplimit 255 accept

		# Allow IPv6 multicast listener discovery on link-local
		ip6 nexthdr icmpv6 icmpv6 type {
			mld-listener-query,  # type 130
			mld-listener-report,  # type 131
			mld-listener-reduction,  # type 132
			mld2-listener-report,  # type 143
		} ip6 saddr fe80::/10 accept

		#  Accept DHCPv6 replies from IPv6 link-local addresses
		ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept
	}

	chain forward {
		type filter hook forward priority 0; policy drop;
	}

	chain output {
		type filter hook output priority 0; policy accept;
	}
}

include "/etc/nftables.d/*.nft"

See: https://wiki.nftables.org/

Both the IPTables example and the NFTables examples are IPv4 for HTTP and HTTPS.