Server- How to allow only selected IP addresses to connect to Pi?

Question

Disclaimer: I don't have in-depth knowledge of networking, so please pardon me if my question doesn't make sense at some places.

I wish to make my Pi a web server on the internet and restrict access to it. The server part is completed and it can be used on the internet (although I haven't started the service or connected the Pi to the internet). However, I am unable to figure out a major security aspect of it all - how to allow only selected IP addresses to connect to it?

The server is meant to be used only by family and friends, so the number of allowable IP addresses is not many. Is there a way I can say to the Pi "hey, allow only these IPs. Ignore every other connection"?

I've checked out UFW but I'm not sure if that is the right option for my case. I always have physical access to the Pi, so I plan to block/disable SSH port completely and allow only 8080 (http) as my server (ngrok based) uses that.

Please advice on what I can do.

Answer 1

Check the documentation of your web server. In Apache, this is done with mod_authz_core:

Require ip <list of addresses>

Before proceeding, check that all your friends actually have static public IP addresses which you could list. Most people have dynamic IPs which change a couple of times a day, making your approach incredibly hard to maintain.

Not to mention that it's pretty bad from the security perspective - you plan to rely on how well your provider blocks traffic with fake IP addresses. And of course your provider's malicious employee would be able to access your website just fine.

Just do that everyone else does: create users with names and passwords, and make sure your server asks for a password before delivering the content. This is easily done if you install a content management system such as Nextcloud or Wordpress.