Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So here's the deal.

I have multiple virtual host. Each virtual is a separate domain. Each domain is for separate applications. Lets say I have virtual hosts for:

http://.abc.com http://.def.com http://foo.com

I then a separate application, which is a RESTful HTTP api for the foo.com application.

What i want to achieve is essentially back channel communication between *.abc.com and *.def.com to api.foo.com. So that *.abc.com, *.def.com and foo.com are publicly accessible (this i have already set setup). But access api.foo.com is only accessible when being requested from the same server.

My criteria is:

  • a 404 should be served to anyone attempting to browse to api.foo.com (not permission denied)
  • access to api.foo.com is restricted to an IP or IP range

I have achieve this by:

  • not setting a dns record for api.foo.com so anyone trying to access it will receive a 404.
  • creating an ip based virtual host for 127.0.0.1:80 and added the follow rule to /etc/hosts

    127.0.0.1 api.foo.com

This works exactly as desired. But is this the correct way to achieve a private virtual host?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Sounds like a good solution for me. You could even scale this to multiple servers if your site grows.

One small hint: Clients wouldn't receive an 404 error, their browser will report them it couldn't find the host to begin with. A 404 means that the browser talked to the server, but the server couldn't finde the requested document.

share|improve this answer
    
Either way is fine. I simply want the api.foo.com sub domain to appear completely non-existent. –  xzyfer Dec 15 '10 at 4:38
    
If api.foo.com only exists in the local hosts file, then you'll get that invisibility, certainly. I would also recommend using mod_access to add IP-based restrictions to access the site, since you can be sure in this case that all legitimate connections would be coming from the local machine. –  SmallClanger Dec 15 '10 at 13:46
    
is that equivalent to setting "Order Deny,Allow", "Deny from all", "Allow <ip1, ip2, ipn>" ? because that is what I have in place atm –  xzyfer Dec 16 '10 at 4:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.