Linux – How to make Ubuntu firewall rules ( ufw ) allow all traffic except…

apache-http-serverfirewalllinuxnetworkingUbuntu

I'm new using Ubuntu and ufw command to set firewall rules. I have an apache service running and I'm able to deny the access to the root path using apache2.conf. I have another backend app running on port 3000 which is not using apache so I can't deny access through apache ( and If I'm able to to that, I don't know how ).

I try then to configure the firewall to deny access ONLY to port 3000, but when I enable the firewall it seems that the fw denies all the traffic.

What is the best way to do that?

Best Answer

I haven't tested this, and am not familiar with ubuntu's ufw but it's a simple interface to iptables and I get the idea looking at ufw commands. And I see you want to change the rule for packets coming in, from a whitelist to a blacklist.

Try ufw default allow in

Use ufw status verbose to check your changes are being made..

more rules listed here https://help.ubuntu.com/community/UFW and http://manpages.ubuntu.com/manpages/lucid/man8/ufw.8.html

and I suppose you can say ufw deny 3000/tcp (though that rule doesn't seem to specify direction)

Related Solutions

Windows – How to configure Windows Firewall to allow all ports in use by IIS Express

There are a couple problems you're running into here. One is that iisexpress.exe isn't actually the process responsible for listening to HTTP traffic. That functionality is implemented in http.sys as a kernel-mode part of the Windows networking stack. (This was done for performance reasons. For more information, see Introduction to IIS Architectures.) Therefore, creating a rule for iisexpress.exe won't do anything.

Secondly, http.sys by default doesn't allow programs running as non-admins listen to other computers. According to Serving External Traffic with WebMatrix, you need to run this command in an administrative command prompt to allow all users to listen to other machines via http.sys:

netsh http add urlacl url=http://MACHNAME:PORT/ user=everyone

Replace MACHNAME with the hostname that will be used to contact the site and PORT with the traffic's port. I have read that using * instead of a specific hostname lets it listen on all names/interfaces, but I have not personally tested that, and some documentation uses + instead. Either way, once you've set the ACL, you can then create an inbound firewall rule for the port.

Further reading: Configuring HTTP and HTTPS.

Side comment: There's an actual environment variable that points to the 32-bit version of Program Files: %PROGRAMFILES(X86)%. (The path wasn't your problem, though.)

Best Answer

Related Solutions

Windows – How to configure Windows Firewall to allow all ports in use by IIS Express

Related Question