1

I'm asking myself whats the best way to block certain IP Addresses (or whole blocks from countries like china, south korea) from accessing my apache2 web server. I'm aware of methods using

Allow from apache.org Allow from .net example.edu

and such things, but if I think correctly they can only be defined within <Directory> (and <Files> or <Location>).

Is there a proper way to handle such an access control for the whole server?

  • 1
    how about using iptables on that box: iptables -I INPUT -s <ip_block> -j DROP – c4urself Dec 22 '14 at 18:13
  • Yeah, I agree with c4urself - iptables feels like the right place to deal with this sort of thing. – James T Snell Dec 22 '14 at 20:18
  • Thanks @c4urself. My current setup is a router which forwardes ports 80 and 443 to that web server device. For now I'm not sure wether I can use iptables on that router, but if I can, I think thats the way to do it! Until then I'll stick to the solution provided below. – Matthias Dec 22 '14 at 21:35
2

I see two points in your question:

  1. "access control for the whole server": you already knows the solution, as per-directory limits can be applied with Directory directive in server-config context (so, system-wide and not related to particular virtual-host) up to "/", so server-wide, for the whole filesystem. As an example, it's common, within httpd.conf, to see something like this:

    <Directory />
            Options FollowSymLinks
            AllowOverride None
    </Directory>
    
  2. "whole blocks from countries like china, south korea": if you want your Apache to filter HTTP requests based on originating countries, a quite effective approach is to rely on the GeoIP services. As for Apache, there's a mod_geoip2 module that you can install on your own Apache installation. Once it's up-and-running, such module will take care, for each HTTP request, to assign an environment variable (GEOIP_COUNTRY_CODE) based on the corresponding ISO 3166-1 country code. Such environment variable, afterwards, can be checked against common filtering directives, to filter the request. A complete example (together with other interesting examples) is provided in the mod_geoip2 page above:


(from: http://dev.maxmind.com/geoip/legacy/mod_geoip2/)

Blocking a client based on country

This example show you how to block clients based on the country code that GeoIP sets.

GeoIPEnable On
GeoIPDBFile /path/to/GeoIP.dat

SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry

# ... place more countries here
Deny from env=BlockCountry

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.