Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My configuration is very simple :

To avoid duplicate content, I want to prevent user to go on my website by hitting directly apache (which is running on port 8080).

I have setup a Varnish server listening on port 80, so I want to use only this to avoid bot indexing the same website on different port which may cause duplicate content issue.

I'm using a dedicated server with Debian 6.

My virtual host looks like :

<VirtualHost *:8080>
    ServerAdmin webmaster@localhost

    DocumentRoot ...
    DirectoryIndex app.php

    <Directory "/var/www/">
        Options -Indexes FollowSymLinks SymLinksifOwnerMatch
        AllowOverride All
        Allow from All

How to prevent user to directly access to the website using port 8080 ? (but I still need varnish to hit apache correctly).


share|improve this question
up vote 2 down vote accepted

You could bind apache daemon to loopback interface and make Varnish to connect to localhost:80. Thus, varnish would be accessible to the world while apache would be accessible only locally.

Varnish config:

backend www {
.host = “localhost″;
.port = “80″;

Apache config:

share|improve this answer
Do you have an example please ? It looks obscure to me as i'm not a sys admin – Tristan Jan 11 '13 at 15:50
I've just edited the answer and included the example. – Gevial Jan 11 '13 at 15:51
Thx i'm going to test it ASAP. – Tristan Jan 11 '13 at 16:05
@Tristan Did this actually work? – cerd Mar 11 '15 at 9:49

Quickest option would be to simply bind the Apache instance to Localhost, so it would only be accessible from that machine.


Alternatively you could tweak the permissions of your Apache Virtual host directory block to:

Deny from all
Allow from  #IP.OF.MY.PC

This is slightly more flexible, as you can add your own IP, or net range to the permitted IP list, to allow a select few direct access for diagnostic purposes.

Both option above assume the Varnish instance is running on the same physical server.

share|improve this answer

Simply block the 8080 port with iptables for the outside world like this:

 # iptables -I INPUT -p tcp --dport 80 -j DROP

 # iptables -I INPUT -s localhost -j ACCEPT
share|improve this answer
It doesn't work, the traffic is all shut down. Varnish can't access to the port 80 (he his on the same server ofc) – Tristan Jan 22 '13 at 18:45
What's the value in the .host section you have given in Varnish. Is it the network interface IP or localhost. It should be localhost, and it will work – GeekRide Jan 22 '13 at 19:02
Also, the sequence in which you executed the iptables rules also matter, it should be same as I pasted above. – GeekRide Jan 22 '13 at 19:02
I know this is what i did, but after that, my website didn't respond. I also tryed to put iptables -I INPUT -s -j ACCEPT but it didn't work. – Tristan Jan 22 '13 at 19:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.