Bsrgvty

Im using ubuntu 18.04 and successfully setup nginx and uwsgi to host multiple websites.

I have an AAAA record mapped to an IPV6 address through my DNS provider, and I have my nginx config file listening on ports 80 and 443 for that IPV6 address.

This setup is working just fine.

However, I would like to restrict IPV6 traffic to ports 80 and 443 to ONLY a few specific IP addresses.

When I list the current ip6table rules using ip6tables -S, there is a line towards the bottom like this.

-A ufw6-user-input -p tcp -m multiport --dports 80,443 -m comment --comment "'dapp_Nginx%20Full'" -j ACCEPT

I am new to iptables in general but from all the reading and tutorials I have done it sounds like:

1. You need to make sure rules are in the correct order.


2. You want to save the rules to a file before making changes in case you screw something up.


3. After you have your rules the way you want them you want to use something like the persistent flag so the rules persist in event of reboot.

My question is what rules would i need to have to achieve the stated goal above, and in what order, and will this only apply to ipv6 traffic on the 80/443 ports?

foo@example:~# sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To Action From
-- ------ ----
22/tcp (OpenSSH) ALLOW IN Anywhere
80,443/tcp (Nginx Full) ALLOW IN Anywhere
22/tcp (OpenSSH (v6)) ALLOW IN Anywhere (v6)
80,443/tcp (Nginx Full (v6)) ALLOW IN Anywhere (v6)

You are already using ufw. So set the rules with ufw.

For IPv4 Allow In to 80,443, try:

ufw allow proto tcp from 0.0.0.0/0 to port 80,443

For IPv6 we need to use a few more rules:

ufw allow proto tcp from IPV6ADDRESS/128 to port 80,443
# Do the above more than once for more than one IPv6 address
ufw deny proto tcp from ::0/0 to port 80,443

Based on the manpage for ufw, this would achieve what you want - allow IPv4 to TCP ports 80 and 443, allow IPV6ADDRESS to TCP ports 80 and 443, and disallow all other IPv6 addresses from reaching TCP ports 80 and 443.

Note that you can't access IPv6 addresses without IPv6 connectivity, so if you don't have IPv6 access on the boxes in question (that're IPv4) you can't really access the v6 address easily.

Note that we ultimately decomplexified this XY Problem via Chat and narrowed down their goals for access control to a specific website/subdomain, and as they were using NGINX as the backend, I provided them the details on how to implement access controls per-site.