While hosting a hidden service, e.g. a website on port 5678 from a device with a local ip address of and a public ip4 address of the gateway of, I noticed that if one is connected to the same, semi-public wifi netwerk, one is able to connect to the "hidden" website simply on the local ip address

It is quite possible that random people see what the local devices, that are also connected to this wifi, are hosting on any open ports. Hence they may (accidentally) find the hidden service locally. This is assumed undesirable, hence I was wondering:

Is there a way to block website access to (the website/hidden service on) port 5678 from all but tor-exit nodes on Ubuntu Server 20.04 LTS?

1 Answer 1


In general you should have a firewall that blocks all incoming connections unless you explicitly add a firewall rule to allow them. You can look into the ufw tool for details. As a Tor onion service does not require any incoming connections, you do not need to unblock any ports.

A separate issue is that you seem to be binding your web server to all network interfaces. Instead, your web server should only bind to localhost. If you're using Apache, you probably have something like Listen *:80 or Listen You should instead only bind to localhost, which means instead using the line Listen When you bind a server to localhost, you can only connect to it from the same server, and not from other servers on the network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .