1

My configuration is very simple :

To avoid duplicate content, I want to prevent user to go on my website by hitting directly apache (which is running on port 8080).

I have setup a Varnish server listening on port 80, so I want to use only this to avoid bot indexing the same website on different port which may cause duplicate content issue.

I'm using a dedicated server with Debian 6.

My virtual host looks like :

<VirtualHost *:8080>
    ServerAdmin webmaster@localhost
    ServerName www.seek-team.com

    DocumentRoot ...
    DirectoryIndex app.php

    <Directory "/var/www/seek-team.com/current/web">
        Options -Indexes FollowSymLinks SymLinksifOwnerMatch
        AllowOverride All
        Allow from All
    </Directory>
</VirtualHost>

How to prevent user to directly access to the website using port 8080 ? (but I still need varnish to hit apache correctly).

Thanks.

2

You could bind apache daemon to loopback interface and make Varnish to connect to localhost:80. Thus, varnish would be accessible to the world while apache would be accessible only locally.

Varnish config:

backend www {
.host = “localhost″;
.port = “80″;
}

Apache config:

Listen 127.0.0.1:8080
...    
<VirtualHost 127.0.0.1:8080>
...
  • Do you have an example please ? It looks obscure to me as i'm not a sys admin – Tristan Jan 11 '13 at 15:50
  • I've just edited the answer and included the example. – Gevial Jan 11 '13 at 15:51
  • Thx i'm going to test it ASAP. – Tristan Jan 11 '13 at 16:05
  • @Tristan Did this actually work? – cerd Mar 11 '15 at 9:49
1

Quickest option would be to simply bind the Apache instance to Localhost, so it would only be accessible from that machine.

<VirtualHost 127.0.0.1:8080>

Alternatively you could tweak the permissions of your Apache Virtual host directory block to:

Deny from all
Allow from 127.0.0.1  #IP.OF.MY.PC

This is slightly more flexible, as you can add your own IP, or net range to the permitted IP list, to allow a select few direct access for diagnostic purposes.

Both option above assume the Varnish instance is running on the same physical server.

1

Simply block the 8080 port with iptables for the outside world like this:

 # iptables -I INPUT -p tcp --dport 80 -j DROP

 # iptables -I INPUT -s localhost -j ACCEPT
  • It doesn't work, the traffic is all shut down. Varnish can't access to the port 80 (he his on the same server ofc) – Tristan Jan 22 '13 at 18:45
  • What's the value in the .host section you have given in Varnish. Is it the network interface IP or localhost. It should be localhost, and it will work – GeekRide Jan 22 '13 at 19:02
  • Also, the sequence in which you executed the iptables rules also matter, it should be same as I pasted above. – GeekRide Jan 22 '13 at 19:02
  • I know this is what i did, but after that, my website didn't respond. I also tryed to put iptables -I INPUT -s 127.0.0.1 -j ACCEPT but it didn't work. – Tristan Jan 22 '13 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.