0

I have a server with Ubuntu server and UFW firewall. Server runs docker, and in docker two containers. One is a proxy server, another is some other service with WebUI on port 42111. This service has no ability for authentication on WebUI.

So I want to somehow block connections to WebUI on port 42111 from the Internet (which is by default with UFW), but allow connections that come from the proxy server on the machine.

How do I set it up properly?

  • 1
    I have a fairly important question: is 'outside' a separate interface or the same interface? Also, how do you determine if the user is or is not coming over the Proxy? Unless you have separate NICs for outside/inside, or unless the users coming over the proxy have unique IP address ranges (and are therefore all in the same IP range) or are all from certain 'internal' ranges, you will not be able to create a rule narrow enough to handle this type of filtering case. – Thomas Ward Apr 29 '18 at 21:11
  • No separate interface. I have just installed proxy server in docker and it just works. Is there really no way to say that connection originates on the same machine? At first I thought that allowing in from 127.0.0.1 would work, but no... – Barafu Albino Apr 29 '18 at 21:21
  • Unless there's a way to do this from differing/unique IP address ranges, or to discern 'outside' connections from 'inside' connections, there's no way to build this rule, because there's no way to discern whether the user has come over the proxy or not. (The other solution is to not run a webUI for the proxy on the same port as the actual proxy itself) – Thomas Ward Apr 29 '18 at 21:40
  • is the server web-facing directly? As in, the server itself running the containers is connected directly to the Internet. If not, then you need to check the firewall / NAT at the router, and ask yourself why port 42111 is able to be reached from the Internet to begin with. – Thomas Ward Apr 29 '18 at 21:54
  • Yes, directly. It is a VPS on DO. – Barafu Albino Apr 29 '18 at 21:57
0

Well, I am not sure what I did, but this line helped.

ufw allow in from 172.17.0.2 to any port 42111 proto tcp

P.S. Don't forget that Docker messes with UFW unless started with argument --iptables=false

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.