How to allow traffic from a specific IP for a specific port in UFW?

Question

I use private networking on Digital Ocean between a load balancer and a webserver (nginx/node). I want the webserver to block all incoming traffic on all ports, except two things:

1. Allow SSH from anywhere
2. Allow HTTP on port 80 only from the loadbalancer IP

I have tried to achieve this with the following ufw commands:

ufw enable
ufw default deny
ufw deny http
ufw deny https
ufw allow ssh
ufw allow from loadbalancer.private.ip to any port 80
ufw allow from loadbalancer.public.ip to any port 80

The result of ufw status verbose shows this:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
80                         DENY IN     Anywhere                  
443                        DENY IN     Anywhere                  
22                         ALLOW IN    Anywhere                  
80                         ALLOW IN    loadbalancer.private.ip              
80                         ALLOW IN    loadbalancer.public.ip            
80 (v6)                    DENY IN     Anywhere (v6)             
443 (v6)                   DENY IN     Anywhere (v6)             
22 (v6)                    ALLOW IN    Anywhere (v6)

The website is not responding and only showing nginx 504 gateway time-out. If I type ufw allow http the site is available. So my above setup must be blocking out the loadbalancer. What is wrong?

Answer 1

Firewall rules are first-matched in terms of processing. If the DENY comes before the ALLOW, it won't work right.

Your ALLOW rules need to come before the DENY rules. Otherwise the first matched rules are the DENY rules and you can't connect as you want.

Answer 2

Old question, but you don't have to specifically deny things in UFW, it's default deny.

In this case, you would only have to add the specific allow rule, for the said IP. And that's it. Nothing else.