-1

I have a web service on an external server, and an openvpn server on the same machine. I need to open port 80, but only for openvpn clients. In other words, if I do nmap-p 80 server_ip I expect to see filtred. However at the same time, if I connect to the vpn and do the same command, I expect to see open.

I'm a programmer, and I don't know much about network administration. If it is possible to make a couple of rules in iptables, please tell me how to write. If it is difficult, then tell me at least in what direction to look. I can not find, on the Internet, a similar case with an explanation of how to do it.

This time, I'm trying to do this on CentOs 7 with firewalld, can it be done using firewalld, or do I need to remove it, and do it via iptables?

migrated from stackoverflow.com Dec 22 '18 at 11:26

This question came from our site for professional and enthusiast programmers.

0

The easy bit

Easiest rule would be to block port 80 (and all un-used ports). Then add a rule before it to allow the local host 127.0.0.0/8 to connect to port 80.

This will cut out most of the possibilities, at least only processes on this machine can connect.

You can do this with the graphical fire-wall tool gufw. gufw is possibly the simplest file-wall tool, it can't do everything, but is simple, and can do a lot.

The harder bit

Next you need to stop processes on the machine connecting. But allow processes from the VPN user to connect, then run the VPN as a separate VPN user. (You can only control out-going connections by user.

I don't know of an easy tool that can do this, (I am not a firewall expert) but you can do it my editing iptables.

Do you have to remove firewalld?

I have not used filewalld, however I have used gufw, and directly edited iptable. I have not seen any conflicts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy