Port 80 forwarding and port blocking
I have a 750Gl that I have a webserver behind. Its address is 10.30.1.70/24.
I had a problem with it getting hacked. After rebuilding it and hopefully fixing my vulnerabilities, I want to go a little further by denying any possible outgoing viruses that might get through in the future. The easiest way I can figure out is to close all outgoing ports except 53 & 80.
I want to allow my webserver to get updates, so I need to allow outgoing port 80 & 53. My webserver is also on port 80.
I have tried a few different ways, but I cannot make anything work properly.
I have tried the configs below. The first works great to block everything outgoing except port 80 & 53. But using it seems to nullify my port forward to the same server on port 80. How can I get this to work?
/ip firewall filter
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=udp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=udp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=80
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=80
add chain=forward action=drop
With a forward like this:
/ip firewall nat
add action=dst-nat chain=dstnat comment="Access to Webserver NAT Rule" disabled=no
dst-port=80 protocol=tcp to-addresses=10.30.1.70 to-ports=80
networking firewall mikrotik
edited Nov 29 '16 at 20:40
Scott
16.1k113990
asked Mar 28 '15 at 6:59
shohelshohel
63
add a comment |
I have a 750Gl that I have a webserver behind. Its address is 10.30.1.70/24.
I had a problem with it getting hacked. After rebuilding it and hopefully fixing my vulnerabilities, I want to go a little further by denying any possible outgoing viruses that might get through in the future. The easiest way I can figure out is to close all outgoing ports except 53 & 80.
I want to allow my webserver to get updates, so I need to allow outgoing port 80 & 53. My webserver is also on port 80.
I have tried a few different ways, but I cannot make anything work properly.
I have tried the configs below. The first works great to block everything outgoing except port 80 & 53. But using it seems to nullify my port forward to the same server on port 80. How can I get this to work?
/ip firewall filter
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=udp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=udp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=80
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=80
add chain=forward action=drop
With a forward like this:
/ip firewall nat
add action=dst-nat chain=dstnat comment="Access to Webserver NAT Rule" disabled=no
dst-port=80 protocol=tcp to-addresses=10.30.1.70 to-ports=80
networking firewall mikrotik
edited Nov 29 '16 at 20:40
Scott
16.1k113990
asked Mar 28 '15 at 6:59
shohelshohel
63
add a comment |
I have a 750Gl that I have a webserver behind. Its address is 10.30.1.70/24.
I had a problem with it getting hacked. After rebuilding it and hopefully fixing my vulnerabilities, I want to go a little further by denying any possible outgoing viruses that might get through in the future. The easiest way I can figure out is to close all outgoing ports except 53 & 80.
I want to allow my webserver to get updates, so I need to allow outgoing port 80 & 53. My webserver is also on port 80.
I have tried a few different ways, but I cannot make anything work properly.
I have tried the configs below. The first works great to block everything outgoing except port 80 & 53. But using it seems to nullify my port forward to the same server on port 80. How can I get this to work?
/ip firewall filter
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=udp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=udp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=80
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=80
add chain=forward action=drop
With a forward like this:
/ip firewall nat
add action=dst-nat chain=dstnat comment="Access to Webserver NAT Rule" disabled=no
dst-port=80 protocol=tcp to-addresses=10.30.1.70 to-ports=80
networking firewall mikrotik
edited Nov 29 '16 at 20:40
Scott
16.1k113990
asked Mar 28 '15 at 6:59
shohelshohel
63
I have a 750Gl that I have a webserver behind. Its address is 10.30.1.70/24.
I had a problem with it getting hacked. After rebuilding it and hopefully fixing my vulnerabilities, I want to go a little further by denying any possible outgoing viruses that might get through in the future. The easiest way I can figure out is to close all outgoing ports except 53 & 80.
I want to allow my webserver to get updates, so I need to allow outgoing port 80 & 53. My webserver is also on port 80.
I have tried a few different ways, but I cannot make anything work properly.
I have tried the configs below. The first works great to block everything outgoing except port 80 & 53. But using it seems to nullify my port forward to the same server on port 80. How can I get this to work?
/ip firewall filter
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=udp dst-port=53
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=udp src-port=53
add chain=forward action=accept src-address=10.30.1.0/24 protocol=tcp dst-port=80
add chain=forward action=accept dst-address=10.30.1.0/24 protocol=tcp src-port=80
add chain=forward action=drop
With a forward like this:
/ip firewall nat
add action=dst-nat chain=dstnat comment="Access to Webserver NAT Rule" disabled=no
dst-port=80 protocol=tcp to-addresses=10.30.1.70 to-ports=80
networking firewall mikrotik
networking firewall mikrotik
edited Nov 29 '16 at 20:40
Scott
16.1k113990
asked Mar 28 '15 at 6:59
shohelshohel
63
edited Nov 29 '16 at 20:40
Scott
16.1k113990
asked Mar 28 '15 at 6:59
shohelshohel
63
edited Nov 29 '16 at 20:40
Scott
16.1k113990
edited Nov 29 '16 at 20:40
Scott
16.1k113990
edited Nov 29 '16 at 20:40
Scott
16.1k113990
16.1k113990
asked Mar 28 '15 at 6:59
shohelshohel
63
asked Mar 28 '15 at 6:59
shohelshohel
63
asked Mar 28 '15 at 6:59
shohelshohel
63
63
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
The problem with what you are proposing is that connections TO the webserver come from random, high ports, not 80. So with that in place it would not be able to serve webpages. So you are doing exactly what you need to do what you're attempting, but what you are attempting to do is fundamentally flawed.
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f895043%2fport-80-forwarding-and-port-blocking%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The problem with what you are proposing is that connections TO the webserver come from random, high ports, not 80. So with that in place it would not be able to serve webpages. So you are doing exactly what you need to do what you're attempting, but what you are attempting to do is fundamentally flawed.
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
add a comment |
The problem with what you are proposing is that connections TO the webserver come from random, high ports, not 80. So with that in place it would not be able to serve webpages. So you are doing exactly what you need to do what you're attempting, but what you are attempting to do is fundamentally flawed.
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
add a comment |
The problem with what you are proposing is that connections TO the webserver come from random, high ports, not 80. So with that in place it would not be able to serve webpages. So you are doing exactly what you need to do what you're attempting, but what you are attempting to do is fundamentally flawed.
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
The problem with what you are proposing is that connections TO the webserver come from random, high ports, not 80. So with that in place it would not be able to serve webpages. So you are doing exactly what you need to do what you're attempting, but what you are attempting to do is fundamentally flawed.
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
answered Apr 9 '17 at 23:54
Duncan X SimpsonDuncan X Simpson
1,112823
1,112823
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f895043%2fport-80-forwarding-and-port-blocking%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
