Weird connections to port 8080

Community Support Firewall
1

When I go to view ‘web activity’ under apache 2 status in the control panel I have all these connections that appear to be trying to access a website on port 8080. This is a brand new server, and I just installed hestia cp on it clean with ubuntu 22.04… iptables has port 8080 blocked… I even went 1 step further and used ip6tables to ban this entire ipv6 subnet but the connections are still listed here… does anyone know how?

image
image2201×1077 509 KB

2

Those look like connections from your Nginx proxy.

3

Looks like its just people accessing the ip https://x.x.x.x/random-queries-here (user receives hestia 404 page on front end) and thats how it shows up… I wonder if there is an easy way to block those…

4

You can edit /etc/nginx/conf.d/a.b.c.d.conf (a.b.c.d is your server’s IP) and add a return 403 directive.

Something like this:

server {
        listen a.b.c.d:80 default_server;
        server_name _;
        access_log off;
        error_log /dev/null;
        return 403;
        location / {
                proxy_pass http://a.b.c.d:8080
   }
}

server {
        listen a.b.c.d:443 default_server ssl;
        server_name _;
        access_log off;
        error_log /dev/null;

        ssl_certificate     /usr/local/hestia/ssl/certificate.crt;
        ssl_certificate_key /usr/local/hestia/ssl/certificate.key;

        return 403;
 
        location / {
                root /var/www/document_errors/;
        }

        location /error/ {
                alias /var/www/document_errors/;
        }
}
1 Like