Search code examples
httpportiptables

Iptables to block http request on port 7880

I have a python service running on port 7880. In that server, I setup iptables rule for tcp/udp protocol and port 7880. For both INPUT and OUTPUT chain. 

sudo iptables -A INPUT -p tcp --dport 7880 -j DROP
sudo iptables -A INPUT -p udp --dport 7880 -j DROP

Still from other machine, I can access port 7880 using curl-X GET http://192.168.100.201:7880

[vagrant@worker-001 run]$ sudo iptables -L -n

Chain INPUT (policy ACCEPT)

target prot opt source destination
f2b-sshd-ddos tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22

f2b-sshd tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22

REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7880 reject-with icmp-port-unreachable

REJECT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:7880 reject-with icmp-port-unreachable

REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:7880 reject-with icmp-port-unreachable

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7880

DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:7880

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7880

DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:7880

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7880 state ESTABLISHED reject-with icmp-port-unreachable

REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:7880 state NEW,ESTABLISHED reject-with icmp-port-unreachable

REJECT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:7880 reject-with icmp-port-unreachable

REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7880 reject-with icmp-port-unreachable

REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:7880 reject-with icmp-port-unreachable

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7880

DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:7880

DROP all -- 192.168.100.101 0.0.0.0/0

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80

Solution

  • This should fix your problem: --dport

    sudo iptables -A INPUT -p tcp --dport 7880 -j DROP
sudo iptables -A INPUT -p udp --dport 7880 -j DROP