2

I'm in process of developing a website for a client. I restrict acces to this website by IP. One of the reviewers of this website has a dynamically assigned (changing) IP address. Is there any way this person can access the website using a static IP address?

6 Answers 6

8

I'd solve the problem a completely different way. Make your own SSL CA, issue them with an x509 certificate, and require that the server verifies their identity with that instead. It's much more elegant than client IP restrictions... Bit of a bugger to set up, but pretty fuckin cool once it's working.

2
  • Yes! I've just updated my answer right before your post :) I think this solution is most elegant so far. Jun 10, 2011 at 14:02
  • I've just implemented it for a client. It's So Pretty. Jun 10, 2011 at 14:06
4

Restricting access based off IP works fine within a corporate network where you have control over the IP addresses, but it's an utterly impractical solution for when you have people accessing the site from the public internet. You cannot rely on people having static addresses are home, because that's just not how the vast majority of ISPs operate.

Some possible alternatives would be HTTP Auth for those from un-trusted IPs, while still allowing those from trusted IPs in without the need to auth, you can do this in the Apache config, I have it working on a number of sites. You could also set up a VPN to allow off-campus people to VPN into the network and hence become on-campus people who's IP address you can control.

Hope that helps,

Bart.

1

i would make them login with a username .htaccess and .htpaswd

http://www.htmlite.com/HTA006.php

1

The direct answer to your question is "No," they need a static IP if you're going to continue to provide access restrictions by source IP. If they use any sort of public proxy, then you're allowing access to anyone else using that proxy.

1

Simpliest way I'd see it is to use a DNS service like DynDNS which with the help of some software allows the dynamic IP to have a FQDN (fully qualified domain name) using one of their domains. The software runs locally on their PC, updates the DNS record if their IP address changes. This way you'd allow whatever.my.host.dyndns.com to view the site and that's it.

DynDNS

3
  • That only works the other way, for people getting to them. Even though www.domain.com will get updated, traffic from their host will still come out whatever random IP address they were assigned so it won't work in this situation.
    – Alex
    Jun 10, 2011 at 14:22
  • Yes it will. You can restrict by FQDN instead of IP. Since the customer can update the FQDN with their dynamic IP the affect is the same.
    – Chris Nava
    Jun 10, 2011 at 14:34
  • Isn't the reverse DNS still going to be the provider's DNS? I don't think there is any way for the receiving end to connect the two.
    – Alex
    Jun 10, 2011 at 15:03
0

Yes, by using the proxy.

..or choosing another restriction method, i.e. hostname mask, certificates, login & cookies, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .