Hello,

I have a Debian web server with shorewall firewall.

For security reasons I closed outgoing connections in FW configuration.

Some websites need to use Curl to get contents from other websites so they need to make outgoing connection to port 80 but I do not want to open port 80 to ALL websites.

I tried to use an external proxy but it becomes a critical point of failure.

I want to permit outgoing connections only from PHP curl calls, but I want to block connections made by apache if there are xss attacks or hacking.

Can I install a proxy on the web server and configure shorewall to permit outgoing connection to port 80 on the net only if they are originated by proxy?

Do you have other suggestions?

Thank you
P.

If your server is running selinux then you can restrict httpd from making any outbound network connections with setsebool

From your firewall's point of view all it knows about is packets, both incomming and outgoing. It doesn't know what or who generates those packets so you have to set the restriction at the operating system level.