3

I tried to install CiviCRM on a server with a firewall that blocks outgoing traffic. But the dashboard wouldn't load. Looking at the logs, it appears CiviCRM tries to connect to civicrm.org. Probably to check for updates. Is there a way to disable all outgoing connections in CiviCRM and run CiviCRM without the server having access to the internet?

Edit: If I add 127.0.0.1 civicrm.org" to the host file, everything works. It looks like it's fine if a server returns 403 it just crashes when it can't connect to civicrm.org.

Background Story

I have a client that stores a lot of sensitive information in CiviCRM. Because of all the security issues that come with all the popular CMS, I lobbied hard to separate CiviCRM from the webpage and to put in onto a separate server and to enforce strict rules for incoming and outgoing traffic.

So, I moved the CiviCRM to a fresh WordPress installation and put the whole thing behind a nginx reverse proxy that I configured as an authentication proxy with 2FA. The only exception I made is for /civi. We need public access to that path so that links in mailings will work. This works fine and should greatly reduce the attack surface.

To further improve security, I also want to block all outgoing traffic except for a few whitelisted ip addresses. The goal of this measure is to reduce the risk of malicious code trying to download further code or uploading any data away from the server.

Improve this question
3
  • Your setup sopunds good for teh future you may want to have a look at CiviProxy which would provide access to mailing ressources ans still keeping your whole CiviCRM environment isolated : docs.civicrm.org/civiproxy/en/latest
    – Fabian
    Commented Sep 27, 2021 at 13:52
  • @Fabian This is exactly the kind of thing I was looking for. We currently have our own syncing mechanism where we have another civicrm that is a clone of the backend civicrm (without data) attached to the website and then we have a syncing mechanism that exports submitted data to an s3 from where the backend civicrm pulls the data. It works pretty well right now but in the future I might take a look at civiproxy.
    – Gellweiler
    Commented Sep 28, 2021 at 7:05
  • Also I only allow GET requests to /civi and throw away any request body. I also block all special characters in the url except for =, : ?, -, / and %2F and I don't allow ./ and .%2F and I only allow urls up to 200 characters which should make most attacks that would be theoretically possible against /civi impossible to exploit. And links in newsletters and pixel tracking still works as they use only alphanumeric ids.
    – Gellweiler
    Commented Sep 28, 2021 at 7:13

2 Answers 2

Reset to default
4

Ok it turns out civicrm will work fine without internet when civicrm.org does not get resolved to an ip address. So in the normal scenario when there is simply no internet connection at all, everything works fine because dns will fail. However when dns gets resolved and the ip is not reachable (due to firewall blocking) civicrm will try to contact civicrm.org indefinitely until php or the webserver times out. I've decided to extend my simple ip whitelisting with dns whitelisting using dnsmasq. So now civicrm gets no longer resolved to an ip and everything works smooth.

A simple workaround if you don't want to setup dns filtering is to add the following to /etc/hosts:

127.0.0.1 civicrm.org

That way all http requests to civicrm are instead redirected to the local webserver that will respond with a 404 or 403 or a wrong tls certificate.

Update: I've wrote a blog post on how to build a whitelist ip/dns filter. Which is what I use for civicrm. You can find it here: https://craftcodecrew.com/building-a-simple-domain-name-based-firewall-for-egress-filtering/.

Improve this answer
1

Civi runs ok without internet. Developer installs run in VMs/offline etc all the time. You can disable the update check at Administer - System Settings - Scheduled Jobs.

Improve this answer
1
  • Yeah but it doesn't as soon as I enable the firewall it will load indefinitely. I imagine it makes a difference if there is no network interface present at all or if the connection just gets blocked. Wordpress itself is running just fine. When I reset the firewall everything works fine again.
    – Gellweiler
    Commented Aug 6, 2021 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.