8

I'm using apache web server on CentOS and I need to disable the ability for people to access the website by using the server's IP address in a web browser. I want it so that when someone attempts to browse to the IP address they get a forbidden error message.

What configurations would be necessary to do that?

10

Just set up the default virtual host. There is a commented example in httpd.conf or do something trivial like:

<VirtualHost *:80>
    ServerName localhost
    DocumentRoot /var/www/html
</VirtualHost>
  • Well, This solved my problem .. many thanks for you all :) – Amr Elkhedewy May 28 '13 at 18:53
7

You can achieve this with mod_rewrite (either in the .htaccess file, or in the default server context, or in a separate VirtualHost where the ServerName is the host's IP address):

RewriteEngine On
RewriteCond %{HTTP_HOST} 1.2.3.4 # Replace with your own IP address
RewriteRule .* - [F]

This says that if the HTTP_HOST header matches the ip address 1.2.3.4, then any request should be met with a 403 Forbidden. Any request that has another HTTP_HOST header (e.g. one with the actual domain name rather than the IP address) should not be affected.

  • It didn't work in httpd.conf – Amr Elkhedewy May 28 '13 at 15:28
  • it worked through .htaccess file, i need it to be done from Apache configurations. – Amr Elkhedewy May 28 '13 at 15:32
  • 2
    Did you restart apache after editing httpd.conf ? Otherwise apache won't know about the new configuration. This is different from .htaccess, which is also parsed without restarting apache. – etagenklo May 28 '13 at 16:48
  • Sure but nothing changed – Amr Elkhedewy May 28 '13 at 18:55
1

You cannot block direct access by IP. You must allow the connection but then decide what to do with it. This could be return a 403, a 404 or redirect them to the desired page. You can do this with mod_rewrite.

 RewriteEngine On
 RewriteCond %{HTTP_HOST} ^123\.123\.123\.123
 RewriteRule ^(.*)$ - [F,L]

This will match the HTTP HOST header passed by the web client. All other requests would pass through.

However, you may want to normalize your URLs for SEO purposes.

With this approach you rewrite anything that does not match the desired result.

RewriteCond %{HTTP_HOST}   !^fully\.qualified\.domain\.name [NC]
RewriteCond %{HTTP_HOST}   !^$
RewriteCond %{SERVER_PORT} !^80$
RewriteRule ^/(.*)         http://fully.qualified.domain.name:%{SERVER_PORT}/$1 [L,R]

Reference: https://httpd.apache.org/docs/2.0/rewrite/rewrite_guide.html#canonicalurl

Reference: http://en.wikipedia.org/wiki/URL_normalization

1

This solution does not cover all cases.

Replace any number or dot in the IP URL by its %## for example 1 by %31... 8 by %38 and you will arrive on the IP, not on the domain url.

Suppose this bad IP, used to ease the explanation: 123.45.6.789

You must use the 2 alternatives for all digits and dots : dot is %2E and 0..9 are %30..%39

RewriteEngine on
RewriteCond %{HTTP_HOST} (1|%31)(2|%32)(3|%33)(\.|%2E)(4|%34)(5%35)(\.|%2E)(6|%36)(\.|%2E)(7|%37)(8|%38)(9|%39)
RewriteRule . - [F]

Ugly, it can be reduced with {1,3} and restrained to valid IP but as it is for your IP, no need to do so.

Do not forget the ports like ":80". HTTP_HOST contains it and SERVER_NAME is not reliable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.