Score:1

Server

Blocking all ports except 80 and 443 with cloudflare

Googlebot

12/16/22, 7:29 AM

I try to block all ports except 22, 80, and 443. I added the following rules to iptables.

*filter
:INPUT ACCEPT [36878:18003219]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [33947:26518456]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -s MY_IP -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -j DROP
COMMIT

Port 22 is working, but Cloudflare cannot connect to the webserver. -A INPUT -j DROP causes the problem. In fact, 443 connection does not match a rule until the end of the list.

249

1 + 10

iptables

cloudflare

Michael Hampton

12/16/22, 10:39 AM

Which specific error did CloudFlare give?

Googlebot

12/16/22, 10:57 AM

@MichaelHampton 504 Gateway time-out.

Michael Hampton

12/16/22, 11:00 AM

I see that you still have not enabled ICMP in your firewall. You really should do that.

Googlebot

12/16/22, 11:00 AM

@MichaelHampton the common CloudFlare error that we are connected to the Cloudflare server, but Cloudflare cannot connect to the host.

Googlebot

12/16/22, 11:00 AM

@MichaelHampton I assumed that I have already done it. How should I do this?

Michael Hampton

12/16/22, 11:01 AM

You only enabled pings. You should enable all ICMP, not just one specific type.

Googlebot

12/16/22, 11:12 AM

@MichaelHampton you mean `iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT`? It had no effect!

Michael Hampton

12/16/22, 11:33 AM

OK, now we're making progress. The only other major problem I see in the firewall is that you have not allowed localhost traffic. This will break a wide variety of services (such as apache or nginx talking to a web application server). It also results in the 504 Gateway Timeout error.

Googlebot

12/16/22, 11:58 AM

@MichaelHampton you mean `iptables -A INPUT -i lo -j ACCEPT`. If yes, I feel stupid. I had tried this and it worked, but I remove it as I thought it reverts the effect of `-A INPUT -j DROP` because of `ACCEPT all -- anywhere anywhere DROP all -- anywhere anywhere ` Now that I think, `DROP` rule is after the `ACCEPT` rule, and should block everything else.

Googlebot

12/16/22, 1:53 PM

@MichaelHampton I did not encounter a page stressing the necessity of ACCEPTing localhost traffic. If you post your advice as an answer, it may help someone else too.

Score:1

Server

Michael Hampton

12/17/22, 9:39 PM

So after a lengthy comment session, here is what we've put together:

When you enabled your custom firewall, CloudFlare reported a 504 Gateway Timeout. But notably, it said that that was the error it received from your server, not that it timed out trying to reach your server. The difference is subtle but important: This means CloudFlare was talking to your server fine, but your server was not talking to itself.

You have a web server that proxies to an internal web application running on localhost. But your custom firewall did not allow localhost connections. This is required for the web server to talk to the web app, as well as for so many other internal services to talk to each other, that every professional firewall builder you ever may use will simply allow localhost traffic without question.

(PS: You should leave ICMP enabled to prevent other sorts of breakage, such as Path MTU Discovery.)

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Blocking all ports except 80 and 443 with cloudflare

TH: บล็อกพอร์ตทั้งหมดยกเว้น 80 และ 443 ด้วย cloudflare

RO: Blocarea tuturor porturilor, cu excepția celor 80 și 443, cu cloudflare

RU: Блокировка всех портов кроме 80 и 443 через cloudflare

VI: Chặn tất cả các cổng trừ 80 và 443 bằng cloudflare

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.