Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are some good ways to prevent public access to a server / app ?

i know i can set up an ssh tunnel, but this requires me to setup a proxy on my local machine and point my browser to it. this is no good since some non devs need to see the app.

i'm talking about preventing access to an app (in a staging environment) that doesn't require much technical work from viewers.

I'm using Ubuntu 12.04


By preventing access i mean, no one except machines i choose can access the application, i don't mean authentication, i'm sure stackexchange does this, i know they did this once using X-Forwarded-For header and checking for ip.

share|improve this question
up vote 0 down vote accepted

Setting up a SSL/TLS VPN or IPsec VPN is a good solution. Just set your app to use a private IP and it will not be publicly routeable. Also this way your users can just connect to the VPN via a shortcut and providing a user name and password. Using some hosts entries on the VPN server you can direct traffic from a domain to the local IP that serves the app. Implement Public Key Infrastructure and your users will only be able to authenticate if they have a key.

share|improve this answer

If you know the IP address(es) that your developers will be connecting from, why not just firewall it off from everybody except them?

share|improve this answer
yeah, but ip's change, can i ensure they use a certain ip ? – Amir Abu Shareb Aug 29 '13 at 12:16
Depends on where they're connecting from I guess. If you don't want to use authentication, and you want to basically make the app unavailable to people other than those you specify, then you're going to need some kind of network level solution, whether that's firewall rules or a VPN tunnel for those you allow access. – Chris McKeown Aug 29 '13 at 12:36

You could use HTTP Basic Authentication:


This has the advantage of letting you give access to others with their own credentials easily, and you don't need to edit the firewall rules.

share|improve this answer
thanks, but i'm asking to prevent complete access, i will edit and explain myself better. – Amir Abu Shareb Aug 29 '13 at 12:10
Reading your edit, it seems that you either want HTTP Basic Authentication (you give a username and password to each user, which can be set as part of the URL: or you want to filter on IP address. – dotancohen Aug 29 '13 at 12:20
so there's no "other ways", the problem with basic auth is that anyone can see there's an app, and it requests username and password.` – Amir Abu Shareb Aug 29 '13 at 12:22
That problem is common to any other way. I suppose that you could use PHP to show an innocuous page if there is no authentication given, and serve the app only if authentication is given. – dotancohen Aug 29 '13 at 12:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.