-1

I have an http server on my Solaris 11 system and I want to block all http requests from other systems. Eventually I will allow access, but for now I cannot figure out how to block access to port 80, as nothing I do seems to work.

I have the following in my /etc/ipf/ipf.conf

# ipf.conf
#
# IP Filter rules to be loaded during startup
#
# See ipf(4) manpage for more information on
# IP Filter rules syntax.
# block in all
block in proto tcp from any to any port = 80
block out quick proto tcp to any port = http keep state

The ipfilter service is running

root@test2:/etc/ipf# svcs ipfilter
STATE          STIME    FMRI
online         19:25:23 svc:/network/ipfilter:default

However, whenever I visit 192.168.1.211 in my browser, I see "It works!" The only thing that seems to work is if I put block in all in the ipf.conf file, but that blocks ALL incoming traffic (including my SSH connection). I am not sure what I am doing. Maybe my syntax is wrong.

0

I have an http server on my Solaris 11 system and I want to block all http requests from other systems.

Assuming your want to allow access from only the actual web server host itself, the easiest way to do that is to simply configure your web server to listen to 127.0.0.1:80 or localhost:80 instead of something like 0.0.0.0:80 or 192.168.1.211:80.

  • Maybe my question is unclear. I am trying to use the firewall to block a particular port. If it helps, just substitute HTTP for SSH. – Timothy Pulliam May 8 '18 at 14:34
  • @TimothyPulliam Why are you using a firewall to block something you don't even need to open in the first place? If you don't want your web server responding to off-host requests, don't configure your web server to answer those request then create something to block them. Why not just configure your web server so it does what you want in the first place? See en.wikipedia.org/wiki/Law_of_the_instrument – Andrew Henle May 8 '18 at 15:06
0

So it seems I needed to set the IP Filter firewall config policy to "custom" and then point it to the location of the ipf.conf file before it would work. Now the changes are working.

$ svccfg -s ipfilter:default setprop firewall_config_default/policy = astring: "custom"
$ svccfg -s ipfilter:default \
setprop firewall_config_default/custom_policy_file = astring: "/etc/ipf/ipf.conf"

Link with relevant docs. I don't know why it seemed to work before, but it is working now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.