Member Avatar for =IceBurn=

Hello!

I'm running a dedicated web server and I'd like to use APF to block HTTP(S) access to certain PORTS from all IP's except from mine.

Anyone knows how to do that?

Many thanks in advance!

Edited by =IceBurn= because: n/a
  • 3 Contributors
  • 3 Replies
  • 673 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by =IceBurn=

Dani AI

Generated

Short summary tied to the thread: ’s approach—using APF’s trust files to permit only your IP while blocking everyone else for specific services—is the right, supported pattern for this problem. APF is an iptables/netfilter frontend with a built‑in “trust” (whitelist/blacklist) system, so you get per-port inbound/outbound control without hand‑crafting raw iptables chains (although using iptables directly, as suggested, remains an option). (rfxn.com)

Practical, safer workflow and checks (don’t repeat the exact lines from the previous post here—use these as complementary tips):

  • Back up /etc/apf before any edits. Use APF’s CLI to add/remove trust entries when possible (avoids parse mistakes) and start in APF’s development/testing mode so a bad rule won’t permanently lock you out while you test.

  • After changes, verify APF’s view and the kernel rules and confirm the service is actually listening. Useful commands:

    apf -l          # list APF rules
apf -t          # firewall status/log
iptables -nvL   # verify kernel packet filters (IPv4)
ss -lntp        # confirm service is listening on the expected port
nmap -p 80,443 target.example.com   # test remotely

    The APF manpage documents the CLI options and the project docs cover the development/test mode details. (manpages.debian.org)

Common pitfalls and troubleshooting:

  • If your home/work IP is dynamic, use a dynamic‑DNS + small automation or a VPN with a static exit IP; otherwise you’ll need to update the allow list whenever your IP changes.
  • Whitelist the external IP the server actually sees (NAT, corporate proxies, or ISP CGNAT can make this non‑obvious). If external tests still show the port open/closed, recheck the service binding, any upstream load‑balancer/firewall, and APF’s rules order (use the list commands above). For dynamic‑IP gotchas and the need to update allow lists frequently, see community notes and APF guides. (abouteye.com)

If console or hosting control‑panel access exists, keep that available until you’ve fully verified the setup.

Recommended Answers

All 3 Replies

Member Avatar for sknake

I have never heard about APF until now but after reading their site:

The technical side of APF is such that it utilizes the latest stable features from the iptables (netfilter) project to provide a very robust and powerful firewall.

Is using iptables directly a solution?

Member Avatar for babystrangeloop

Based on these instructions:

http://www.webhostgear.com/406.html

1) Login to your server as the root user.

2) cd /etc/apf

3) Use vi or nano or emacs to edit the /etc/apf/allow_hosts.rules file

e.g.: vi /etc/apf/allow_hosts.rules

4) Scroll down until after their last comment with the ##

Add the following in:

tcp:in:d=443:s=YOURHOMEIPHERE
out:d=443:d=YOURHOMEIPHERE

The d=443 part is the https port, so you can repeat for other services as well to limit connections if you like.

You must change YOURHOMEIPHERE to the IP address you want to let in. If this is going over the Internet you need to know your external IP address. Try http://www.ipaddressworld.com/ or some such service to see what your external IP address is.
e.g.

Save the changes.

5) Edit the /etc/apf/deny_hosts.rules file
EG: vi /etc/apf/deny_hosts.rules

Scroll down until the last default comment ## then below it add the following:

tcp:in:d=443:s=0/0
out:d=443:d=0/0

Save the changes.

6) Restart APF firewall
apf -r

commented: Great help provided :) +2
Member Avatar for =IceBurn=

Thank you sknake, but no, iptables directly was not an option.

Thank you babystrangeloop, that's it! :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.