Can I use httpd to only allow IP addresses?

[openletter]

I am wondering if there is a way with httpd.conf to allow only the listed IP addresses? I can see there is a from option in relayd.conf:

from address[/prefix]

This rule only matches for connections from the specified source.

Is there something similar for httpd.conf?

[jggimi]

Not to my knowledge. I perceive 3 choices:

1. Use relayd(8).
2. Use client certificates. This is what I do to authenticate clients from any address.
3. Use pf(4).

[openletter]

At this point, I feel relayd is a more new-user-friendly option.

Can relayd and httpd work side-by-side? Or would I need to configure other sites served by httpd to use relayd?

[jggimi]

The use of relayd(8) would be as a front-end to your webserver, acting as a transparent proxy.

I think pf(4) would be far more "new user friendly" than relayd.

[openletter]

Well, mostly I'm new to OpenBSD as I've been using nginx on Ubuntu for the past 8 years. I don't normally use the reverse proxy features, but I'm familiar with its configuration in nginx. However, I've generally shied away from directly managing firewall rulesets (e.g., in Ubuntu I just run UFW).

[jggimi]

If I understand your use-case, a two-line pf(4) rule set on the webserver would address it. Perhaps something on the order of:

block
pass in proto tcp from <table.of.addresses> to self port { 80 443 }

You're certainly welcome to provision a redirection chain between relayd(8) and httpd(8), but I think you'll find the provisioning effort will be more complex than the example I've provided here.

You could also install the nginx package as you're already comfortable with it.

[johnR]

Originally Posted by openletter

I've generally shied away from directly managing firewall rulesets

I've just switched my web and mail server from Linux to OpenBSD. After many years of wrestling with ipchains and iptables rules, pf is a positive delight. It's well worth learning how to configure it.

I recommend "The Book of PF" by Peter N M Hansteen as an easy-to-read (and fairly in-depth) tutorial.

[openletter]

Thanks, guys.

I also found iptables very difficult and on more than one occasion broke a server, so I basically gave up on managing firewalls at the rule level.

I'm wanting to convert everything over to OpenBSD. I like it better, it's just new and I'm not the best at figuring out where to start, but I do try to read the man pages carefully, including the "see also" section at the end of each one.

I'll give that pf rule a try and pick up that book.

[jggimi]

Just to note that the example above is a "default block" ruleset. Only packets from your table of pre-approved CIDRs or individual addresses are allowed to reach processes. If your webserver needs other network services, including DNS, they would need to be passed also.

The ruleset can be converted to a "default pass" if preferred.