Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Clodflare DNS. I only want to allow certain IPs to access certain files.

How can I set up my lighttpd.conf to properly detect the correct IP? I know how to do it for the access.log. Is it possible to use $HTTP["remoteip"] together withsomething else?

This is how I do it today:

 $HTTP["remoteip"] == "xx.xx.xx.xx" {
    url.access-deny = ("")
}

I have tried with the following but it didnt work:

 $HTTP["remoteip"] =="*"{
   extforward.forwarder = ( "all" => "trust" )
   extforward.headers = ("CF-Connecting-IP")
 }
share|improve this question

2 Answers 2

$HTTP["remoteip"] will never equal the string *, it will have a value representing the connecting IP address (some Cloudflare address in your case).

Having that condition in place means that the extforward settings inside are never applied, which would appear to be your problem.

As for extforward.forwarder = ( "all" => "trust"), this may not be a good idea if non-Cloudflare addresses can connect. Allowing anyone to specify the remote address in a header makes any kind of access checks based on IP trivial to circumvent.

Cloudflare do have some documentation on this as well.

share|improve this answer
    
I managed to get it to work now. The Cloduflare setting example didnt work 100% for me. I will post my solution once I am able. –  Kaah Jun 22 at 21:50

The settings from the Cloudflare seem to give errors due to duplicate entries of IPs.

Here is the settings that works for me. I put them after server.modules { .. }:

$HTTP["remoteip"] == "199.27.128.0/21" {
extforward.forwarder = ( "all" => "trust" )
extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "173.245.48.0/20" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "103.21.244.0/22" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "103.22.200.0/22" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "103.31.4.0/22" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "141.101.64.0/18" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "108.162.192.0/18" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "190.93.240.0/20" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "188.114.96.0/20" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "197.234.240.0/22" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "198.41.128.0/17" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "162.158.0.0/15" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}
$HTTP["remoteip"] == "104.16.0.0/12" {
    extforward.forwarder = ( "all" => "trust" )
    extforward.headers = ("CF-Connecting-IP")
}

With this $HTTP["remoteip"] works fine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.