0

I would like to prevent default virtual host behaviour by dropping the connection, so that visitors who navigate to my server via IP or fqdn that isn't included in my virtual hosts get no indication that any web server exists (other than seeing open port 443).

At the moment I am using mod_security to drop request in phase 1, but this still results in 403 response being sent to clients, indicating that Apache exists there.

I also thought about switching to nginx so that I could utilize error code 444, and while this sends no meaningful response to clients, it still sends packets with no content back to clients indicating ERR_EMPTY_RESPONSE, and that there is a service listening on that port (and possibly hints to existence of nginx).

Is there a possibility to drop the request altogether so that no reply us ever sent to the client matching the default virtual host? Preferably without ever establishing connection, so the client eventually times out on their request with ERR_CONNECTION_TIMED_OUT or ERR_CONNECTION_REFUSED error?

I've tried redirects, gone, 404, 403, mod_security drop (which produces 403). My next line of experimentation will probably be routing to non-existent, or pointing to dev>null, but I am looking for elegant and simple solution, and preferably one that is resistant to resource depletion under dos attack scenarios.

I know that many people are looking for a way to fix their connection refused errors here, I am trying to cause it for specific virtual hosts, without affecting others. Any insights are appreciated.

2
  • If you selectively serve certain domains and not others and anyone interested can determine that this is the case, why do you want a special case for those domains you do not serve? What is wrong with the 403 answer?
    – anx
    Jul 14, 2022 at 1:35
  • Are you aware of the edge case where SNI domain does not equal the host specified for HTTP requests? Are you willing to also make your site unavailable to clients not sending plaintext SNI?
    – anx
    Jul 14, 2022 at 1:38

0

You must log in to answer this question.

Browse other questions tagged .