0

I am running an express server on port 3000 of my local machine. Because I share my local network with other people I want to prevent connections to my server using my machine's local address (192.168.1.X). I am on Windows.

I am also curious if people would be able to "discover" my server without explicitly knowing my machine's local address is running a server and the port the server is hosted on?

Improve this question

1 Answer 1

Reset to default
1

When you start any server which listen to some port, you need also choose to which network interface it should do bind. There is at least two network interfaces on your machine right now: a ethernet/wireless interface, and a loopback interface. Each interface has an IP address: probably your ethernet/wireless interface has address similar to 192.168.0.42 (two last numbers can be different). In contrast, loopback interface always has an IP address 127.0.0.1. This is by convention.

Loopback interface is special. It literally means "connect to host itself, from host itself".

When your server binds to ethernet/wireless interface, it can accept connections from any device in network it connected to. But when server binds to loopback interface, it can accept connections only from host itself.

So all you need to do in order to prevent other people from connecting to your host serving your app is to configure server to bind only to loopback interface - 127.0.0.1. You need to check express documentation to find out how to do that.

Bonus.

The server also can be bound to 0.0.0.0 IP address, which literally means "listen on all available interfaces".

Bonus. Discovery.

Yes, other people can scan network and see other machine's IP addresses. Next, they can scan each machine ports to see which is opened (there is only 65536 possible ports). But, they probably can't know that particular machine is yours - there is no such information available by scanning. They can use other heuristics to gather more info about each machine, (for example, they can guess OS type fairly accurate). But all of this is indirect information.

Improve this answer
2
  • Maybe this isn't an appropriate way to accomplish this, but in theory could I also block incoming and outgoing connections for specific ports in Windows Firewall to achieve the same effect?
    – No stupid questions
    Sep 3, 2020 at 23:23
  • Yes, you can do that. But blocking incoming connection with firewall is proactive solution. IMO, it is better to not to have possibility to do wrong thing in the first place, rather than to prevent it.
    – Anthony
    Sep 5, 2020 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.