I'm trying to configure a microservice for my web application, which is hosted at ip address
X.X.X.X. The microservice should only accept https connections from this web app.
I've tested the microservice as working from the webserver with liberal "allow everything" ip tables rules, but my rules below (specifically, the last 2) aren't letting me through.
Here's the head of my
iptables rules at the moment:
#allow current ssh connection so we don't disconnect ourselves iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT #allow ssh traffic iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT #allow ssh web traffic only from nominated webserver iptables -A INPUT -p tcp -s X.X.X.X/32 --dport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -d X.X.X.X/32 --sport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
I've double checked the
X.X.X.X ip is correct, and the web app's proxy has the same IP (it's nginx on the same server). What am I screwing up?
Edit: output of
target prot opt source destination ACCEPT tcp -- X-X-X-X.rev.cloud.scaleway.com anywhere tcp dpt:https state ESTABLISHED
Does this mean that somehow my "source" ip isn't actually the source of the request I think I'm sending? (and is instead the scaleway VPS provider?)