mjhjmtu

I have an http server on my Solaris 11 system and I want to block all http requests from other systems. Eventually I will allow access, but for now I cannot figure out how to block access to port 80, as nothing I do seems to work.

I have the following in my /etc/ipf/ipf.conf

# ipf.conf
#
# IP Filter rules to be loaded during startup
#
# See ipf(4) manpage for more information on
# IP Filter rules syntax.
# block in all
block in proto tcp from any to any port = 80
block out quick proto tcp to any port = http keep state

The ipfilter service is running

root@test2:/etc/ipf# svcs ipfilter
STATE STIME FMRI
online 19:25:23 svc:/network/ipfilter:default

However, whenever I visit 192.168.1.211 in my browser, I see "It works!" The only thing that seems to work is if I put block in all in the ipf.conf file, but that blocks ALL incoming traffic (including my SSH connection). I am not sure what I am doing. Maybe my syntax is wrong.

I have an http server on my Solaris 11 system and I want to block all http requests from other systems.

Assuming your want to allow access from only the actual web server host itself, the easiest way to do that is to simply configure your web server to listen to 127.0.0.1:80 or localhost:80 instead of something like 0.0.0.0:80 or 192.168.1.211:80.

So it seems I needed to set the IP Filter firewall config policy to "custom" and then point it to the location of the ipf.conf file before it would work. Now the changes are working.

$ svccfg -s ipfilter:default setprop firewall_config_default/policy = astring: "custom"
$ svccfg -s ipfilter:default 
setprop firewall_config_default/custom_policy_file = astring: "/etc/ipf/ipf.conf"

Link with relevant docs. I don't know why it seemed to work before, but it is working now.