block outside access to port so only apache proxy pass serves sites

Question

I ran into a problem I'm not able to fix. I have a server with some applications (a ghost blog and gogs for example) that are listening on specific ports. I want apache to handle them via proxypass. So far so good, I can specify a subdomain and let the requests through to the applications. But all my applications are still reachable via the specific port they run on. I can't let apache listen to this ports because, well, the ports are in use by the applications.

I'm just wondering is there a way to let any apllications just listen on a port and be reachable from locahost (so that only apache can reach them with that port) or is there any other way to limit the access to my applications so that they are only reachable through apache? Is there a solution I can use for all applications or do I have to tweak every single app myself?

Googling it just didn't get me the rights answers (lots of port 80 to https and so on)

Thank you for every answer / tipp / nudge in the right direction you can give me.

Best regards.

Answer 1

Allright, the biggest problem is always in front of the computer :)

I never thought about iptables, I don't know why, because I'm quite familiar with it. For anyone else having the same stupidity problem I had:

Make a rule that allows localhost to access this port:

iptables -A INPUT -p tcp -s localhost --dport 25 -j ACCEPT

Then just block every connection on that port with iptables

iptables -A INPUT -p tcp --dport 25 -j DROP

Don't forget to change 25 to your specific port.

Best regards.