Apache Server Port Configuration

Question

When I run Apache and have it configured to listen at ports 80 and 443, is it only listening for local traffic on my network? How can I tell if my server is visible to the web? (I want to keep it private for local development purposes) I think that for others to have access to my server, I would have to actually open up ports 80 and 443 on my router, but I have to say I'm pretty confused. Any help would be appreciated!

Answer 1

The ports have nothing to do with whether it's visible on the web. It's the IP address that the server is listening on and whether that IP address is allowed, to accept inbound connections if there is a firewall in front of it. So if you are using Localhost or an RFC 1918 IP address, then there is nothing to worry about. It has to use a publicly accessible IP address or hostname.

When Apache starts, it binds to some port and address on the local machine and waits for incoming requests. By default, it listens to all addresses on the machine. However, it may need to be told to listen on specific ports, or only on selected addresses, or a combination of both. This is often combined with the Virtual Host feature, which determines how Apache responds to different IP addresses, hostnames and ports.

https://httpd.apache.org/docs/2.2/bind.html

Also if you are behind a router, until you port forward your router on 80 or 443, nothing is going to get through from the outside.

Answer 2

You did not specify the OS/distribution you are using so it's a little hard to guess where you apache.conf or httpd.conf is located, you need to find it (including the ssl.conf file).

Somewhere right at the top you will find a few lines talking about "Listen: allows you to bind apache". You can limit this to your network of your local computer including localhost, now assuming you ipaddress is 192.168.10.1:

Listen 127.0.0.1:80
Listen 192.168.10.1:80

A little further down you will find a section talking about "DocumentRoot", right after that it will talk about "Directory", make it look like:

<Directory />
  Order Allow, Deny
  Deny From All
  allow from 192.168.0.0
  allow from 127.0.0.1
</Directory>

and depending where your document root is:

<Directory /var/www>
  Order Allow, Deny
  Deny From All
  allow from 192.168.0.0
  allow from 127.0.0.1
</Directory>

This will only allow local traffic to get to your server. You need to make sure that your ip address is within the range of 192.168.0.0.

Note that you need to do the same in the file called "ssl.conf".