8

I have a CentOS server running Apache 2.2.15. If the IP address of the server is 198.51.100.4 and I write in browser http://198.51.100.4 it goes on my website.

I want to prevent this. I want my website to be accessible only on the FQDN i.e. http://example.com/.

How can I configure my server so the website is not accessible when I visit the IP address?

  • 2
    Possible duplicate of Apache accepting requests to other servers? – Jenny D Dec 14 '15 at 13:16
  • While the question does not quite match the duplicate I've linked to, the answer to that question is also the answer to this one. – Jenny D Dec 14 '15 at 13:17
  • I am curious as to why you would do that. reverse DNS is a thing. – njzk2 Dec 14 '15 at 22:18
6

You can use Alias * to catch any other trafic than thoose allowed in your virtual host, for this you have to use in the last position a virtual host with * as alias.

Like that only defined domain will be served.

<VirtualHost *:80>
ServerName mywebsite.com
DocumentRoot /var/www/default
...
</VirtualHost>

<VirtualHost *:80>
ServerName another.mywebsite.com
DocumentRoot /var/www/another
...
</VirtualHost>

# /!\ THIS HAS TO BE ON THE LAST POSITION /!\
<VirtualHost *:80 *:443>
# [ Server Domain ]
ServerName localhost
ServerAlias *
# [ Cancel trafic ]
RewriteRule .* - [END,R=406]
# [ Custom Log ]
CustomLog ${APACHE_LOG_DIR}/other.log combined
</VirtualHost>

In my example only mywebsite.com & another.mywebsite.com will be allowed, all other domains or IP will have trafic cancelled.

To cancel the trafic you can use a redirect to - and then add an error code, for example i used a RewriteRule to redirect to 406 Not Acceptable (R=406).

Here you can find the list of redirect codes: https://fr.wikipedia.org/wiki/Liste_des_codes_HTTP

  • Thanks! I tried your method and it works. But I changed a bit. I created a new virtualhost and I put as ServerName the IP address of the server + RewriteRule :) – antiks Dec 15 '15 at 8:53
11

You can add a default virtual host that just gives a "denied" error, or whatever. When a browser then comes to your webserver without a host in the URL that matches any ServerName or ServerAlias lines in other virtual hosts will be served by the default virtual host.

So in your apache config:

<VirtualHost *:80>
    ServerName default
    DocumentRoot /var/www/default
    ...
</VirtualHost>

<VirtualHost *:80>
    ServerName mywebsite.com
    ...
</VirtualHost>
0

You need a rewrite rule like this:

 RewriteEngine On
 RewriteCond %{HTTP_HOST} !^mywebsite.com$
 RewriteRule /.* https://mywebsite.com/ [R]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.