1

I'd like to locally test my web application's behavior under different firewall circumstances.

We have an application that makes requests from the browser to different ports depending upon certain conditions, and I'd like to set up a firewall that allows me to modify firewall rules dynamically so as to see how the application behaves when a port is disabled.

I'd like to do this by setting up a firewall that blocks requests from my machine to a port on a guest machine.

I'm running OS X Sierra with Virtualbox, using pfctl.

I started with this command (on the host), attempting to block ports on the guest (at 192.168.99.100), but I haven't had any success:

block in quick inet proto { tcp, udp } from any to 192.168.99.100 port 63342

closed as off-topic by slm Aug 3 '18 at 22:47

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – slm
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Block it on the host machine? – ivanivan Aug 3 '18 at 1:28
1

This seems a little counter intuitive to me in how you're approaching it. Typically you'd setup the firewall on the actual server where the web application is residing.

If you're using firewalld this is pretty trivial. You can see the names of all the services it's able to deal with by name using this command:

$ firewall-cmd --get-services
web names
$ firewall-cmd --get-services | grep -oE '\shttp[s]*'
 http
 https

To allow these two protocols into the VM:

$ firewall-cmd --permanent --add-service http --add-service https
success

$ firewall-cmd --reload
success

Your firewall is now configured like so:

$ firewall-cmd --list-all
public (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: eth0 eth1
  sources:
  services: ssh dhcpv6-client http https
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

The above states that 4 services are allowed in, everything else will get dropped (DROP) based on the default target.

References

  • "This seems a little counter intuitive to me in how you're approaching it." I've updated the question to clarify what I'm doing. Thanks! – Brian Dant Aug 3 '18 at 13:38
  • @BrianDant - thanks for updating. I still do not understand why you cannot merely do the firewall within the VM? Doing it in the VM or on the laptop is merely a semantics, and is easier to accomplish within the VM IMO. – slm Aug 3 '18 at 16:15
  • 1
    Yes, I should have included a note about that, too. I'm using boot2docker as a VM, which, according to stackoverflow.com/a/36576817/785400, I should heed this "word of warning": "you shouldn't treat the docker-machine VM as a regular VM where you install tons of packages and customize. It's only meant to run containers. It's best to keep it that way." So I veered away from this. But your point is valid otherwise, as far as I can see. Thanks again! – Brian Dant Aug 3 '18 at 17:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.