19

I want to restrict direct IP access to my website. I found several solutions involving .htaccess but none work. I've also found one solution via apache virtual hosts config which was working fine up until I installed a SSL certificate through CPanel. I have absolutely no idea what was altered in the httpd.conf file but now the redirect setting does not work even if I uninstall the SSL certificate.

Here's my current virtual hosts setup:

NameVirtualHost 192.168.1.1:80 NameVirtualHost *

<VirtualHost 192.168.1.1:80>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin [email protected]
    UseCanonicalName Off

    ## User rotate # Needed for Cpanel::ApacheConf
    UserDir disabled
    UserDir enabled rotate
    ScriptAlias /cgi-bin/ /home/rotate/public_html/cgi-bin/
</VirtualHost>

<VirtualHost 192.168.1.1:80>
    ServerName 192.168.1.1
    Redirect 403 /
    ErrorDocument 403 "Sorry, direct IP access not allowed."
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin [email protected]
    UseCanonicalName Off
    UserDir disabled
</VirtualHost>

<VirtualHost *>
    ServerName server.mysite.com
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin [email protected]
    UserDir disabled
</VirtualHost>

NameVirtualHost 192.168.1.1:443
<VirtualHost 192.168.1.1:443>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin [email protected]
    UseCanonicalName Off

    UserDir disabled
    UserDir enabled rotate

    ScriptAlias /cgi-bin/ /home/rotate/public_html/cgi-bin/
    SSLEngine on
    #SSL stuff here
</VirtualHost>

IP and names were substituted with generic ones. The "Redirect 403 /" part is not working since installing the SSL certificate. I'd be grateful if someone can shed some light on what am I doing wrong here. Thanks.

5
  • i guess you dont have to use = ServerName 192.168.1.1
    – ADM
    Jun 22, 2014 at 19:08
  • Tried that too, doesn't have any effect.
    – Ivan
    Jun 22, 2014 at 19:13
  • Were the VirtualHosts reordered? Was the one with the 403 error the first (default) vhost before? Jun 22, 2014 at 20:43
  • No the order hasn't change. Problem started after adding the SSL certificate, meaning the last one was simply added. Now if I even remove it completely it won't work anymore so something else was definitely changed too but can't seem to figure out what.
    – Ivan
    Jun 23, 2014 at 9:09
  • here is the solution via htaccess serverfault.com/a/171260/273980
    – jsHate
    Mar 2, 2015 at 9:56

10 Answers 10

15

And voila, the fix:

<VirtualHost mysite.com:80>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin [email protected]
    UseCanonicalName Off
</VirtualHost>

NameVirtualHost mysite.com:80
<VirtualHost 192.168.1.1:80>
    ServerName 192.168.1.1
    Redirect 403 /
    ErrorDocument 403 "Sorry, direct IP access not allowed."
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin [email protected]
    UseCanonicalName Off
    UserDir disabled
</VirtualHost>

<VirtualHost *>
    ServerName server.mysite.com
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin [email protected]
    UserDir disabled
</VirtualHost>

NameVirtualHost mysite.com:443
<VirtualHost mysite.com:443>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin [email protected]
    UseCanonicalName Off
</VirtualHost>

The solution was to simply replace the IP with the domain name for all virtualhost settings, except for the one which needs to redirect/restrict direct IP access.

1
  • This will cause issues with clients running IE6 and IE8. If you're okay with that, then this is fine. They should upgrade their ancient browsers anyway. Jun 23, 2014 at 11:52
10

The answer could be much much simpler.

Just copy this into bottom of httpd.conf (usually located at /etc/httpd/conf)

<VirtualHost *:80>
ServerName localhost
Redirect 403 /
UseCanonicalName Off
UserDir disabled
</VirtualHost>

<VirtualHost *:80>
ServerName www.example.com
DocumentRoot /var/www/html
</VirtualHost>

Then only when visitors access by www.example.com, he can gain access to the server.

1
  • This ONLY works if you have no https
    – Kukeltje
    Sep 1, 2021 at 12:28
4

You can't disable direct IP access to your server over HTTPS because the hostname for your virtualhost is encrypted inside the SSL certificate.

Clients must connect to your IP address, download the certificate, read the contents, and then they can verify that the hostname is correct.

The only other way is by enforcing SNI, but you'll cause problems for users that are browsing with older versions of Internet Explorer.

2

In an Apcahe setup having multiple .conf files, the precedence goes to the first file loaded and then the second..likewise. So if you are on Ubuntu, files are loaded in lexicographic order, so the very "first" .conf file that will be loaded will be the 000-default.conf (hence the 000 in its name) residing under the /etc/apache2/sites-available/ directory.

So In order to prevent any other rule from being applied we need to get our rule to the top of that first file.

and you can just prepend the following rule to that file.

<VirtualHost *:80>
    ServerName default
    DocumentRoot /var/www/html
    #This part here, is crucial.
    <Location />
        Require all denied
    </Location>
</VirtualHost>

Tried and tested on Ubuntu 16.4 x64 Apache version > 2.4

If you are running a lower version of Apache try replacing Require all denied from the above code to ...

<Location />
    Order deny,allow
    Deny from all
</Location>
2

Under the ubuntu 20.04

Server version: Apache/2.4.41 (Ubuntu)

i just copied my 000-default-ssl.conf as disable-ip.ssl.conf and put below the content

cd /etc/apache2/sites-available
cp 000-default-ssl.conf disable-ip.ssl.conf

content of disable-ip.ssl.conf vhost file

<IfModule mod_ssl.c>
        <VirtualHost *:443>
                ServerAdmin root@localhost
                ServerName localhost
                ServerAlias XXX.XXX.XX.XX  # here write ip adresss of your web site
                UseCanonicalName Off
                Redirect 403 /
                ErrorDocument 403 "Sorry, direct IP access not allowed."

                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined

                SSLEngine on

                <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>

                SSLCertificateFile    /etc/letsencrypt/live/domain.com/fullchain.pem
                SSLCertificateKeyFile /etc/letsencrypt/live/domain.com/privkey.pem
                Include /etc/letsencrypt/options-ssl-apache.conf
        </VirtualHost>
</IfModule>

then

a2ensite disable-ip.ssl.conf
service apache2 restart
1
  1. Probably your certificate is issued to example.com, not to 192.168.1.1, nor both; So, visitors who use https://192.168.1.1 should have an SSL error (because URL differs from certificate's one).
  2. You have no 'default SSL' website <VirtualHost *:443> SSLEngine on </VirtualHost>
  3. You should use apache with SNI support (there are some libSSL and Apache version Requirements) to use SSL-per-hostname (see Using Multiple SSL Certificates in Apache with One IP Address
0

I believe this is what your looking for

http://www.htaccess-guide.com/deny-visitors-by-ip-address/

3
  • 1
    No, that has nothing to do with my issue. I want to block website access for those who access my website's IP instead of it's DNS.
    – Ivan
    Jun 22, 2014 at 20:18
  • that does exactly that ....
    – user155813
    Jun 23, 2014 at 14:35
  • 1
    No, this blocks site access by the client's IP address. The question is looking for a way to block access to the site using its IP address. Jan 12, 2016 at 21:13
0

To add another answer, mod_security, if it's worth it to you to set up, has rules to forbid access to the server by ip address.

0

This can be easy if you don't put your files in the default /var/www/html directory. Just create an other directory, lets say /web for example :

mkdir /web 
mkdir /web/example

copy your files and change the chown :

sudo chown -R www-data:www-data /web

Then create a virtual host with the following config :

<Directory /web/example>
  Require all granted
</Directory>

<VirtualHost *:80>

    DocumentRoot /web/example
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin [email protected]

    # Force SSL, you can remove this line
    Redirect permanent / https://example.com/

    ServerAdmin [email protected]

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

# If you use SSL
<IfModule mod_ssl.c>
    <VirtualHost *:443>
        DocumentRoot /web/example
        ServerName example.com
        ServerAlias www.example.com
        ServerAdmin [email protected]

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # adapt this to your paths
        SSLEngine on
        SSLCertificateFile /etc/ssl/example/example_com.crt
        SSLCertificateKeyFile /etc/ssl/example/example.key
        SSLCertificateChainFile /etc/ssl/example/example_com.ca-bundle

    </VirtualHost>
</IfModule>

Do not forget to enable your virtual host , example :

sudo a2ensite example.com.conf
-3

I wrote this simple code in PHP to restrict direct ip access!

$servername =  $_SERVER['SERVER_NAME'];
if($servername == 'your-domain.com'){

}elseif($servername == 'your-domain-with-www.com'){

}else{
    die("Direct ip access not allowed!");
}

just paste into your php file and enjoy!

2
  • 1
    Could you explain the advantages of this over the other answers?
    – 030
    Apr 19, 2017 at 13:47
  • 1
    this is the most simple method you can use to restrict direct ip access to your website, without editing apache settings!
    – Max Marley
    May 5, 2017 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .