4

I'm setting up a LAMP stack on my local machine for testing. How do I make sure the web server is not remote accessible?

  • 1
    Use a private IP address. en.wikipedia.org/wiki/Private_network Make sure you are not using NAT for the IP address range. These IP addresses are not supposed to be routable. Just make sure you are not using a highly predicable IP address such as 10.0.0.1, 10.0.0.2, etc. You may need to use the IP range on more than one computer so that you can see your server. – closetnoc Mar 25 '16 at 12:16
  • 1
    Assuming you are accessing the internet behind a router then... Unless you specifically setup port forwarding to forward requests made to your external IP on port 80 to your web server hosted on your local machine then your web server is not going to be accessible remotely. – MrWhite Mar 25 '16 at 14:31
3

I have a better approach to this:

There is a Listen directive in apache that allows you to specify which ports and IP addresses you want apache to work with.

For 100% security away from the outside world, use the following setting:

Listen 127.0.0.1:80

That IP address 127.0.0.1 represents localhost and is never accessible to anyone outside. Any outsider trying to access your site via that address will either get a bunch of errors or resources from their computer only.

When using this setup, start your URLs with http://127.0.0.1 when running tests.

  • Could you elaborate a bit on where I specify this? Place Listen 127.0.0.1:80 in http.conf, is it that easy? – PetaspeedBeaver Mar 31 '16 at 14:36
  • More precisely: On Apache2, where should I put it? – PetaspeedBeaver Mar 31 '16 at 15:31
3

In your http configuration file set up Allow from and Deny from rules.

Example:

Deny from all
Allow from 127.0.0.1 

(insert your ip address in place of the 127.0.0.1)

The exact rule is different on apache 2.2 vs 2.4

Review this page to see the difference betweeen 2.2 and 2.4: https://httpd.apache.org/docs/2.4/upgrading.html

Example Deny All Rule 2.2 vs 2.4:

2.2 configuration:
Order deny,allow
Deny from all

2.4 configuration:
Require all denied
2

I recommend setting up a Virtual Machine (VirtualBox or VMWare) with LAMP set up within that. You can use ssh to interact with, send, or retrieve files in/out of the Virtual Machine or you can use a virtual monitor to connect to the desktop. You only have to worry about outside access if you explicitly set it up and you can set up your application just as if it was on a production server with a FCDN (www.Example.test) by editing your host file.

When developing a LAMP application I like to keep my bare metal OS and development environments separate.

Your Local machine got a virus? Just save the Virtual Machine with your lamp stack somewhere else and refactor your local drive.

You messed up a setting in your LAMP setup? just use the Virtual Machine software to roll back.

During backup do you back up the full os or just the new LAMP code you are working on? With this setup you back up everything on the virtual machine including setting, files, "hardware" specs... Everything.

What about the dependent software? Are you comfortable having those potentially exposed on your local machine?

A virtual machine makes all of these questions moot and will make your development process a lot easier.

Also as long as you are not using NAT on your router or some similar setup you should be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.