0

I have a web server that I would like to hide. Any requests to my ip should get dropped - the server should not ever even know that they existed. But, requests with actual hostnames should go through.

How do I do this? As far as I can tell, UFW (the firewall I'm using) does not allow for http header parsing.

I'm using Arch Linux.

1
  • 3
    You need to filter on layer 7 information, so you want to be looking into tools like Reverse Proxies/ALGs and WAFs. Those are big topics though, so we probably can't walk you through it end to end. May 31, 2021 at 21:27

4 Answers 4

4

That's not possible. For the client to send its request (with or without "magic" hostname), a TCP connection has to be established first.

You could of course terminate/blackhole the connection if the desired Host header does not appear, but that's not very hidden.

1

Despite the claims of other answers, this is possible.

The solution that springs to mind is to add a reverse proxy which can forward on requests to the web server after matching the host. Indeed this is exactly the kind of thing services like Cloudflare offer.

It would not be possible to do this using simple firewall rules because a connection needs to be made to the IP address before the domain name is communicated. (Id not recommend it but it might be possible to inspect the packet contents and look for the domain name header and you could then block on this - conceivably using iptables/ufw - but this could leave open connections to the webserver, and in any event would not happen before the web server sees the traffic)

1

In the end I decided to look into mod_security for Apache. That looks like it does what I want it to (the drop command). It seems however there is no mod_security in the native Arch repositories so Arch might not be the best system for such a setup.

0

Not possible, in this context the IP address and the hostname are intrinsically tied together.

It's like asking you to go deliver a pizza to John Smiths house, but blacking out his name in the only address book you have.

2
  • That is incorrect. The hostname and IP addresses may be related but a hostname can exist fine on multiple machines and/or be associated with miltiple addresses. Similarly, a single IP address can provide services for multiple domains.
    – davidgo
    May 31, 2021 at 23:34
  • 1
    That might be true, but the OP is asking for any requests that only specify the IP address to be totally ignored when using UFW. Hence why I stated, in this context they are tied together. There is no way (at least that I am aware of) to do this with UFW as a front door/edge device, as you yourself state in your own answer. Jun 1, 2021 at 2:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .