Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having a bit of a trouble here. I have this several rewrite rules which I think does not work.

My main purpose is to restrict pages and allow only specific IP or network block.

RewriteEngine On
RewriteLog "/data/wre/var/logs/modrewrite.log"
RewriteLogLevel 5

RewriteCond %{REMOTE_ADDR} !^192\.168\.10\..*
RewriteCond %{REMOTE_ADDR} !^72\.139\.201\..*
RewriteCond %{REMOTE_ADDR} !^129\.233\.4\..*
RewriteCond %{REMOTE_ADDR} !^208\.118\.97\32
RewriteRule ^/solutions https://example.com/account/signin?go=outside [R,NE,NC]

I tested this again and it seems not to work? Did I did something wrong?

share|improve this question
    
if you want to allow why are you using the ! in front of the ips ? –  Prix Aug 25 '10 at 1:06
    
I mean allow those IP only? am I doing it wrong? –  Louie Miranda Aug 25 '10 at 1:28
    
if you want to allow those ips you should not use the NEGATIVE ! in front of it. –  Prix Aug 25 '10 at 2:00
    
Will post another answer below. –  Louie Miranda Aug 25 '10 at 2:09
add comment

4 Answers

Try this:

RewriteEngine On
RewriteLog "/data/wre/var/logs/modrewrite.log"
RewriteLogLevel 5

RewriteCond %{REMOTE_ADDR} ^192\.168\.10\..* [OR]
RewriteCond %{REMOTE_ADDR} ^72\.139\.201\..* [OR]
RewriteCond %{REMOTE_ADDR} ^129\.233\.4\..*  [OR]
RewriteCond %{REMOTE_ADDR} ^208\.118\.97\.32
RewriteRule ^/solutions https://example.com/account/signin?go=outside [NE,NC,R=301]

Note, multiple RewriteCond directives are implicitly AND'd, you need to specify if they should be OR'd instead. If you want the browser to remember the redirection, specifying a permanent redirection might save some future processing.

Depending on your config, it might be easier to specify the Known Good ranges and redirect for everyone else. From the rewrite manual on redirecting foreigners: Apache Manual

RewriteEngine on
RewriteCond   %{REMOTE_HOST}  !^.+\.ourdomain\.com$
RewriteRule   ^/solutions      https://example.com/account/signin?go=outside [NE,NC,R=301]
share|improve this answer
    
Under, RewriteCond %{REMOTE_ADDR} ^208\.118\.97\.32 Should I add a dollar sign $ on .32? Making it RewriteCond %{REMOTE_ADDR} ^208\.118\.97\.32$? –  Louie Miranda Aug 25 '10 at 2:12
    
Well, I thought about that, and it would be an illegal IP to have the last octet of 32[1-9], so I figured it wouldn't make any difference. Up to you. –  Grizly Aug 25 '10 at 2:52
    
Ahh, just read your rationale for using "!".. those are the IP's you wish to allow then.. should probably put them back in. –  Grizly Aug 25 '10 at 3:01
add comment

Prix, I'm actually following this.

http://www.the-art-of-web.com/system/rewrite/

Conversely, you may want to allow only certain IP addresses to access the site:

RewriteCond %{REMOTE_ADDR} !^12\.34\.56\.78$
RewriteCond %{REMOTE_ADDR} !^87\.65\.43\.21$
RewriteCond %{REQUEST_URI} !^sorry\.html  
RewriteRule .* /sorry.html 
Translation:

IF their IP address is not 12.34.56.78 
AND their IP address is not 87.65.43.21 
AND the request is not for sorry.html 
THEN display the sorry.html page 
share|improve this answer
    
What i am confused about is, do you want to ALLOW those ips in the question or do you want to block them ? because this answer here does what it is supose to do, it will block those ip. –  Prix Aug 25 '10 at 3:04
add comment

This 2 should be set either in the VirtualHost or Directory to work out:

RewriteLog "/data/wre/var/logs/modrewrite.log"
RewriteLogLevel 5

You could try what you want like this:

RewriteCond %{REMOTE_ADDR} ^192\.168\.10\. [OR]
RewriteCond %{REMOTE_ADDR} ^72\.139\.201\. [OR]
RewriteCond %{REMOTE_ADDR} ^129\.233\.4\.  [OR]
RewriteCond %{REMOTE_ADDR} ^208\.118\.97\.32$

which would translate to:

  • if ip starts with 192.168.10.
  • or ip starts with 72.139.201.
  • or ip starts with 129.233.4.
  • or ip is 208.118.97.32
share|improve this answer
add comment

Maybe I'm misunderstanding what you are wanting to do, but if I do understand what you are trying to do, it looks like you are doing in an incredibly complex way.

If it is for the whole site or an entire directory why not just use the allow directive in a directory of virtualhost stanza, as appropriate?

http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#allow

And set the 403 error page to be sorry.html http://httpd.apache.org/docs/2.2/mod/core.html#errordocument

So something like:

<directory "/path/to/content/" >

Order Allow,Deny
Allow 192.168.0.0/255.255.0.0  # allow everyone from the 192.168.0.0/255.255.0.0 network
# every one else gets denied (default for stuff that has not matched is to the 
# last clause of the Order directive
# the error document for a 403 (forbidden) is the sorry.html page
ErrorDocument 403  /sorry.html

</directory> 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.