I have a web service on an external server, and an openvpn server on the same machine. I need to open port 80, but only for openvpn clients. In other words, if I do nmap-p 80 server_ip I expect to see filtred. However at the same time, if I connect to the vpn and do the same command, I expect to see open.

I'm a programmer, and I don't know much about network administration. If it is possible to make a couple of rules in iptables, please tell me how to write. If it is difficult, then tell me at least in what direction to look. I can not find, on the Internet, a similar case with an explanation of how to do it.

This time, I'm trying to do this on CentOs 7 with firewalld, can it be done using firewalld, or do I need to remove it, and do it via iptables?

migrated from stackoverflow.com Dec 22 '18 at 11:26

This question came from our site for professional and enthusiast programmers.


The easy bit

Easiest rule would be to block port 80 (and all un-used ports). Then add a rule before it to allow the local host to connect to port 80.

This will cut out most of the possibilities, at least only processes on this machine can connect.

You can do this with the graphical fire-wall tool gufw. gufw is possibly the simplest file-wall tool, it can't do everything, but is simple, and can do a lot.

The harder bit

Next you need to stop processes on the machine connecting. But allow processes from the VPN user to connect, then run the VPN as a separate VPN user. (You can only control out-going connections by user.

I don't know of an easy tool that can do this, (I am not a firewall expert) but you can do it my editing iptables.

Do you have to remove firewalld?

I have not used filewalld, however I have used gufw, and directly edited iptable. I have not seen any conflicts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy