2

This is my httpd.config file How to disable direct IP access ? If anyone types in the ip address of the site then it should not redirect to the default domain name or the site which is xxx.com in this example

    <VirtualHost ipaddress:8080>

            ServerName xxx.com
            ServerAlias www.xxx.com
            ServerAdmin info@xxx.com
            DocumentRoot /home/admin/web/xxx.com/public_html
            ScriptAlias /cgi-bin/ /home/admin/web/xxx.com/cgi-bin/
            Alias /vstats/ /home/admin/web/xxxcom/stats/
            Alias /error/ /home/admin/web/xxx.com/document_errors/
            .
            .
            .
    </VirtualHost>
  • 2
    Deny all requests to the default server and create a named virtual server. – simlev Apr 4 '17 at 14:19
7

I'm expanding my comment into an answer in order to provide the detailed configuration in response to the OP's further inquiry. My recommendation is moving your config into VirtualHost blocks to allow for increased flexibility. Only the essential bits are shown here:

<VirtualHost *:80>
    ServerName default
    DocumentRoot /home/admin/web/xxx.com/public_html
    <Location />
        Require all denied
    </Location>
</VirtualHost>

<VirtualHost *:80>
    ServerName domain.com
    DocumentRoot /home/admin/web/xxx.com/public_html
</VirtualHost>

default can be any name or the server's IP address.

domain.com is the domain you want your server to respond to.

Explanation: When called with the IP address, apache elaborates the request with the default VirtualHost. The first VirtualHost defined is the default, regardless of its ServerName. Of course, setting the ServerName to the IP address also works, and will leave the default server free to be used otherwise. The location block denies every request to the whole VirtualHost.

Edit: I later saw that the question is tagged apache-2.2, while my answer uses apache-2.4 syntax. On apache-2.2 the line Require all denied must be substituted with two lines: Order deny,allow and Deny from all. Additionally, a NameVirtualHost *:80 is required before the VirtualHost definitions.

Update: The question has been updated so I think it's best to provide the configuration for apache-2.2, including all necessary lines. The same explanation as above applies.

Listen 8080
NameVirtualHost ipaddress:8080
<Directory "/home/admin/web/xxx.com/public_html">
    Order allow,deny
    Allow from all
</Directory>

<VirtualHost ipaddress:8080>
    ServerName ipaddress
    DocumentRoot /home/admin/web/xxx.com/public_html
    <Location />
        Order deny,allow
        Deny from all
    </Location>
</VirtualHost>

<VirtualHost ipaddress:8080>
    ServerName xxx.com
    DocumentRoot /home/admin/web/xxx.com/public_html
</VirtualHost>

Comment: I agree that there are other valid solutions; however, this is how I like to organize my config files, with security restraints inside Directory or Location blocks so I know where to look for them.

| improve this answer | |
  • "The location block" - Why use the <Location> wrapper if denying access to everything anyway? – MrWhite Apr 4 '17 at 17:10
  • 2
    @w3dk Following your comment, I tried omitting the Location directive but I got Syntax error: order not allowed here. What are you suggesting? – simlev Apr 5 '17 at 10:19
2

the IP will always be accessed (after all thats what your domains point to), what you can do is check which Hostname the request was used to make:

For Instance use mod-rewrite:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^192\.168\.0\.1$
RewriteRule .* - [F,L]

you could also chose to redirect all hostnames you don't like

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.thedomainiwant\.com$ [NC]
RewriteRule .* http://www.thedomainiwant.com%{REQUEST_URI} [R=301,L]

alternatively use https:// the rewrite ;-)

| improve this answer | |
1

Yet another way using mod_setenvif

 SetEnvIf HTTP_HOST ^[0-9].+[0-9]$ HOST_NODNS
 Deny from env=HOST_NODNS
| improve this answer | |
  • "...using mod_alias" - These directives belong to mod_setenvif and mod_authz_host (Apache 2.2) respectively, not mod_alias. You would also need to change the SetEnvIf directive to something like: SetEnvIf Host ^[0-9] HOST_NODNS to catch an IP address (or, strictly speaking, a host that starts with a digit). ^[0-9].+[0-9]$ would never actually match an IP address. – MrWhite Apr 4 '17 at 16:53
  • 1
    printf "127.0.0.1" | egrep '^[0-9].+[0-9]$' 127.0.0.1 – Aaron Apr 4 '17 at 18:20
  • Ah yes, of course, sorry! :) – MrWhite Apr 4 '17 at 18:56
  • use HOST instead of HTTP_HOST – Obay Abd-Algader Feb 26 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.