Member Avatar for =IceBurn=

Hello!

Here's the deal, my server has at least 5 different IP's.

What is need is to in some of that IP's block specifique ports.

Example:
-> Port 4000 is open, I want it open!
-> Port 4000 is open, I want it closed!

I'm using APF firewall. Can someone help?

Many thanks in advance.

  • 1 Contributor
  • 1 Reply
  • 133 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by =IceBurn=

Dani AI

Generated

As found, APF can enforce per-IP, per-port rules so one address on a multi‑IP server can expose a service while another address does not. That is the simplest, clean solution when the service itself is fine and you only want packet-level filtering per virtual IP.

Quick checklist to avoid false negatives:

  • Confirm the service is listening where you expect (bound address vs 0.0.0.0). If it listens on all addresses, the firewall must block the specific destination IP/port.
  • Make changes in APF’s host-based rule file (so they survive reloads) and then reload APF rather than editing iptables directly.
  • Verify the generated iptables state after reload to ensure the rule is present and ordered correctly.

Useful commands to inspect and reload (run as root):

ss -lntp
netstat -tulpn
iptables -L -n -v
apf -r
# or on some systems:
service apf restart

If you need a quick iptables test (remember APF will overwrite manual iptables changes on reload), use a rule that targets the destination IP and TCP/UDP port:

iptables -I INPUT -d <IP_TO_BLOCK> -p tcp --dport <PORT> -j DROP

Troubleshooting tips: use REJECT instead of DROP for immediate connection feedback during testing, add a temporary LOG rule to confirm hits, check for interfering services (fail2ban, other firewall managers), and remember APF doesn’t manage IPv6 by default. Test from an external host (or use nmap) to confirm the behavior once rules are in place.

Member Avatar for =IceBurn=

Nevermind, I got it! :)

Here is the solution for anyone who needs it:

In deny_hosts.rules file add
out:d=4000:d=

Thanks.

Edited by =IceBurn= because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.