Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in process of developing a website for a client. I restrict acces to this website by IP. One of the reviewers of this website has a dynamically assigned (changing) IP address. Is there any way this person can access the website using a static IP address?

share|improve this question

I'd solve the problem a completely different way. Make your own SSL CA, issue them with an x509 certificate, and require that the server verifies their identity with that instead. It's much more elegant than client IP restrictions... Bit of a bugger to set up, but pretty fuckin cool once it's working.

share|improve this answer
Yes! I've just updated my answer right before your post :) I think this solution is most elegant so far. – Andrejs Cainikovs Jun 10 '11 at 14:02
I've just implemented it for a client. It's So Pretty. – Tom O'Connor Jun 10 '11 at 14:06

Restricting access based off IP works fine within a corporate network where you have control over the IP addresses, but it's an utterly impractical solution for when you have people accessing the site from the public internet. You cannot rely on people having static addresses are home, because that's just not how the vast majority of ISPs operate.

Some possible alternatives would be HTTP Auth for those from un-trusted IPs, while still allowing those from trusted IPs in without the need to auth, you can do this in the Apache config, I have it working on a number of sites. You could also set up a VPN to allow off-campus people to VPN into the network and hence become on-campus people who's IP address you can control.

Hope that helps,


share|improve this answer

i would make them login with a username .htaccess and .htpaswd

share|improve this answer

The direct answer to your question is "No," they need a static IP if you're going to continue to provide access restrictions by source IP. If they use any sort of public proxy, then you're allowing access to anyone else using that proxy.

share|improve this answer

Simpliest way I'd see it is to use a DNS service like DynDNS which with the help of some software allows the dynamic IP to have a FQDN (fully qualified domain name) using one of their domains. The software runs locally on their PC, updates the DNS record if their IP address changes. This way you'd allow to view the site and that's it.


share|improve this answer
That only works the other way, for people getting to them. Even though will get updated, traffic from their host will still come out whatever random IP address they were assigned so it won't work in this situation. – Alex Jun 10 '11 at 14:22
Yes it will. You can restrict by FQDN instead of IP. Since the customer can update the FQDN with their dynamic IP the affect is the same. – Chris Nava Jun 10 '11 at 14:34
Isn't the reverse DNS still going to be the provider's DNS? I don't think there is any way for the receiving end to connect the two. – Alex Jun 10 '11 at 15:03

Yes, by using the proxy.

..or choosing another restriction method, i.e. hostname mask, certificates, login & cookies, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.