How to allow hidden services on a port whilst blocking the port on a local wifi?

Question

While hosting a hidden service, e.g. a website on port 5678 from a device with a local ip address of 123.4.5.67 and a public ip4 address of the gateway of 78.9.0.12, I noticed that if one is connected to the same, semi-public wifi netwerk, one is able to connect to the "hidden" website simply on the local ip address 123.4.5.67:5678.

It is quite possible that random people see what the local devices, that are also connected to this wifi, are hosting on any open ports. Hence they may (accidentally) find the hidden service locally. This is assumed undesirable, hence I was wondering:

Is there a way to block website access to (the website/hidden service on) port 5678 from all but tor-exit nodes on Ubuntu Server 20.04 LTS?

Answer 1

In general you should have a firewall that blocks all incoming connections unless you explicitly add a firewall rule to allow them. You can look into the ufw tool for details. As a Tor onion service does not require any incoming connections, you do not need to unblock any ports.

A separate issue is that you seem to be binding your web server to all network interfaces. Instead, your web server should only bind to localhost. If you're using Apache, you probably have something like Listen *:80 or Listen 0.0.0.0:80. You should instead only bind to localhost, which means instead using the line Listen 127.0.0.1:80. When you bind a server to localhost, you can only connect to it from the same server, and not from other servers on the network.