13

I want to restrict direct IP access to my website. I found several solutions involving .htaccess but none work. I've also found one solution via apache virtual hosts config which was working fine up until I installed a SSL certificate through CPanel. I have absolutely no idea what was altered in the httpd.conf file but now the redirect setting does not work even if I uninstall the SSL certificate.

Here's my current virtual hosts setup:

NameVirtualHost 192.168.1.1:80 NameVirtualHost *

<VirtualHost 192.168.1.1:80>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin me@mysite.com
    UseCanonicalName Off

    ## User rotate # Needed for Cpanel::ApacheConf
    UserDir disabled
    UserDir enabled rotate
    ScriptAlias /cgi-bin/ /home/rotate/public_html/cgi-bin/
</VirtualHost>

<VirtualHost 192.168.1.1:80>
    ServerName 192.168.1.1
    Redirect 403 /
    ErrorDocument 403 "Sorry, direct IP access not allowed."
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin me@mysite.com
    UseCanonicalName Off
    UserDir disabled
</VirtualHost>

<VirtualHost *>
    ServerName server.mysite.com
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin me@mysite.com
    UserDir disabled
</VirtualHost>

NameVirtualHost 192.168.1.1:443
<VirtualHost 192.168.1.1:443>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin me@mysite.com
    UseCanonicalName Off

    UserDir disabled
    UserDir enabled rotate

    ScriptAlias /cgi-bin/ /home/rotate/public_html/cgi-bin/
    SSLEngine on
    #SSL stuff here
</VirtualHost>

IP and names were substituted with generic ones. The "Redirect 403 /" part is not working since installing the SSL certificate. I'd be grateful if someone can shed some light on what am I doing wrong here. Thanks.

  • i guess you dont have to use = ServerName 192.168.1.1 – ADM Jun 22 '14 at 19:08
  • Tried that too, doesn't have any effect. – Ivan Jun 22 '14 at 19:13
  • Were the VirtualHosts reordered? Was the one with the 403 error the first (default) vhost before? – Håkan Lindqvist Jun 22 '14 at 20:43
  • No the order hasn't change. Problem started after adding the SSL certificate, meaning the last one was simply added. Now if I even remove it completely it won't work anymore so something else was definitely changed too but can't seem to figure out what. – Ivan Jun 23 '14 at 9:09
  • here is the solution via htaccess serverfault.com/a/171260/273980 – jsHate Mar 2 '15 at 9:56
12

And voila, the fix:

<VirtualHost mysite.com:80>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin me@mysite.com
    UseCanonicalName Off
</VirtualHost>

NameVirtualHost mysite.com:80
<VirtualHost 192.168.1.1:80>
    ServerName 192.168.1.1
    Redirect 403 /
    ErrorDocument 403 "Sorry, direct IP access not allowed."
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin me@mysite.com
    UseCanonicalName Off
    UserDir disabled
</VirtualHost>

<VirtualHost *>
    ServerName server.mysite.com
    DocumentRoot /usr/local/apache/htdocs
    ServerAdmin me@mysite.com
    UserDir disabled
</VirtualHost>

NameVirtualHost mysite.com:443
<VirtualHost mysite.com:443>
    ServerName mysite.com
    ServerAlias www.mysite.com
    DocumentRoot /home/rotate/public_html
    ServerAdmin me@mysite.com
    UseCanonicalName Off
</VirtualHost>

The solution was to simply replace the IP with the domain name for all virtualhost settings, except for the one which needs to redirect/restrict direct IP access.

  • This will cause issues with clients running IE6 and IE8. If you're okay with that, then this is fine. They should upgrade their ancient browsers anyway. – Vasili Syrakis Jun 23 '14 at 11:52
6

The answer could be much much simpler.

Just copy this into bottom of httpd.conf (usually located at /etc/httpd/conf)

<VirtualHost *:80>
ServerName localhost
Redirect 403 /
UseCanonicalName Off
UserDir disabled
</VirtualHost>

<VirtualHost *:80>
ServerName www.example.com
DocumentRoot /var/www/html
</VirtualHost>

Then only when visitors access by www.example.com, he can gain access to the server.

2

You can't disable direct IP access to your server over HTTPS because the hostname for your virtualhost is encrypted inside the SSL certificate.

Clients must connect to your IP address, download the certificate, read the contents, and then they can verify that the hostname is correct.

The only other way is by enforcing SNI, but you'll cause problems for users that are browsing with older versions of Internet Explorer.

1
  1. Probably your certificate is issued to example.com, not to 192.168.1.1, nor both; So, visitors who use https://192.168.1.1 should have an SSL error (because URL differs from certificate's one).
  2. You have no 'default SSL' website <VirtualHost *:443> SSLEngine on </VirtualHost>
  3. You should use apache with SNI support (there are some libSSL and Apache version Requirements) to use SSL-per-hostname (see Using Multiple SSL Certificates in Apache with One IP Address
0

I believe this is what your looking for

http://www.htaccess-guide.com/deny-visitors-by-ip-address/

  • 1
    No, that has nothing to do with my issue. I want to block website access for those who access my website's IP instead of it's DNS. – Ivan Jun 22 '14 at 20:18
  • that does exactly that .... – user155813 Jun 23 '14 at 14:35
  • 1
    No, this blocks site access by the client's IP address. The question is looking for a way to block access to the site using its IP address. – DavidB Jan 12 '16 at 21:13
0

To add another answer, mod_security, if it's worth it to you to set up, has rules to forbid access to the server by ip address.

0

This can be easy if you don't put your files in the default /var/www/html directory. Just create an other directory, lets say /web for example :

mkdir /web 
mkdir /web/example

copy your files and change the chown :

sudo chown -R www-data:www-data /web

Then create a virtual host with the following config :

<Directory /web/example>
  Require all granted
</Directory>

<VirtualHost *:80>

    DocumentRoot /web/example
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin webmaster@example.com

    # Force SSL, you can remove this line
    Redirect permanent / https://example.com/

    ServerAdmin webmaster@example.com

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

# If you use SSL
<IfModule mod_ssl.c>
    <VirtualHost *:443>
        DocumentRoot /web/example
        ServerName example.com
        ServerAlias www.example.com
        ServerAdmin webmaster@example.com

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # adapt this to your paths
        SSLEngine on
        SSLCertificateFile /etc/ssl/example/example_com.crt
        SSLCertificateKeyFile /etc/ssl/example/example.key
        SSLCertificateChainFile /etc/ssl/example/example_com.ca-bundle

    </VirtualHost>
</IfModule>

Do not forget to enable your virtual host , example :

sudo a2ensite example.com.conf
0

In an Apcahe setup having multiple .conf files, the precedence goes to the first file loaded and then the second..likewise. So if you are on Ubuntu, files are loaded in lexicographic order, so the very "first" .conf file that will be loaded will be the 000-default.conf (hence the 000 in its name) residing under the /etc/apache2/sites-available/ directory.

So In order to prevent any other rule from being applied we need to get our rule to the top of that first file.

and you can just prepend the following rule to that file.

<VirtualHost *:80>
    ServerName default
    DocumentRoot /var/www/html
    #This part here, is crucial.
    <Location />
        Require all denied
    </Location>
</VirtualHost>

Tried and tested on Ubuntu 16.4 x64 Apache version > 2.4

If you are running a lower version of Apache try replacing Require all denied from the above code to ...

<Location />
    Order deny,allow
    Deny from all
</Location>
-2

I wrote this simple code in PHP to restrict direct ip access!

$servername =  $_SERVER['SERVER_NAME'];
if($servername == 'your-domain.com'){

}elseif($servername == 'your-domain-with-www.com'){

}else{
    die("Direct ip access not allowed!");
}

just paste into your php file and enjoy!

  • 1
    Could you explain the advantages of this over the other answers? – 030 Apr 19 '17 at 13:47
  • this is the most simple method you can use to restrict direct ip access to your website, without editing apache settings! – Max Marley May 5 '17 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.