I had a cloud server with two ip, and each ip is configured respectively with
wildfly server. In each of them there are some domain/vhost setup in production.
Checking the apache access log (and also widlfy log on the same cloud) I see many HTTP CONNECT request like them:
192.99.xxx.xxx - - [21/Jun/2019:09:58:03 +0200] "CONNECT www.instagram.com:443 HTTP/1.1" 200 - "-" "-" 118.24.xxx.xxx - - [21/Jun/2019:09:59:20 +0200] "CONNECT api.zxkjj.cn:443 HTTP/1.1" 200 - "-" "Python/3.6 aiohttp/3.4.4"
and so on..
Are some try to hack my server? Why I received them? And.. How to block it without write
iptables rules for each domain or ip?
Additional Info: I wish to block the unwanted request directly from apache configuration. Dropping request with mod_security will be the best instead of http 403.
My httpd.conf is very simple:
A default virtual host with following setup:
<VirtualHost _default_:*> ServerName catchall <Location /> Deny from all Options None </Location> </VirtualHost>
and a second virtualhost with following setup:
<VirtualHost myserverip:80> DocumentRoot "/var/www/mydir" ServerName www.mydomain.com SSLProxyEngine on ProxyRequests Off <Directory "/var/www/mydir"> Options FollowSymLinks AllowOverride All Order deny,allow Allow from all </Directory> <Proxy *> Order Deny,Allow Deny from all Allow from www.mydomain.com </Proxy> </VirtualHost>
but I continue to get request in the second virtual host as explained in my first question.
Where am I wrong?