mod_rewrite to protect files via HTTP_REFERER

my rewritecond's are blocking all visitors from viewing site!

[RedScourge]

heres my rewrite work:

Options Indexes IncludesNOEXEC FollowSymLinks MultiViews
RewriteEngine On
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?redscourge\.example\.com?
RewriteCond %{HTTP_REFERER} !^http://(www\.)?smart_redirector\.com?
RewriteCond %{HTTP_REFERER} !^http://(www\.)?192\.***\.0\.1(:8080)?
RewriteCond %{HTTP_REFERER} !^http://localhost(:8080)?
RewriteRule !^\.(php多tml多tm)$ - [F,L]

ok ive got a series of problems: i dont seem to get the proper HTTP-_REFERER anymore, i use a subdomain redirect service called "smart_redirector" and i USED TO get entries in my logs that people viewed my pages and had an http_referer of [name.subdomain.com...] , but now i am getting nothing for this.

the problem is though, see im trying to block anyone without the above http_referer values from accessing files, images for one, but others as well. the problem is that either the rewrite is messing up and im not getting the right value for http_referer for some reason, or theres something wrong with how i am trying to use mod_rewrite.

ive tried sifting thru the forum charter links but its not really helping, i now understand how to do regex's a little better, but i dont know.

i had to comment ou all my mod_rewrite stuff above in order to allow visitors to see my main page at all.

something tells me that the problem lies within the first condition.

see what im trying to do is make it so only html, php, and htm files can be accessed directly from another site, i dont want people stealing my bandwidth for images, programs, etc.

[edited by: jdMorgan at 12:56 am (utc) on Nov. 25, 2004]
[edit reason] Various fix-ups [/edit]

[jdMorgan]

You might consider dumping the redirect service, you can do that yourself. Do a search of WebmasterWorld for "Rewrite arbitrary subdomains to subdirectories rewriterule" for a compact solution.

On the face of it, there's nothing wrong with your code. Take a look at your server error log to see what's going wrong.

Jim

[jdMorgan]

Oh, wait there it is...

RewriteRule [b]!^\[/b].(php多tml多tm)$ - [F,L]

should be

RewriteRule [b]!\[/b].(php多tml?)$ - [F]

You had the pattern start-anchored (so the requested file had to *start* with a period), and [L] used with [F] is redundant.

Also "html?" is equivalent to "html多tm".

Jim

[RedScourge]

see the thing is i dont own a domain name, and i have a dynamic ip address. every time i restart my computer, my ip address changes, luckily this doesnt happen with DHCP leases or what have you, so it doesnt happen to me every 24 hours. as a matter of fact now that i think of it, when i go home back to where i have a DSL connection that uses the 24 hour ip leases, i might be screwed, changing my IP in my various configuration files daily at within 5 minutes of the same time isnt something i really wanna have to do. right now it only takes me about 2 minutes to do...but do i really have any other options though?

[jdMorgan]

Yes,

Get a domain name -- *any* domain name has got to be better than an IP, especially one that changes.
Get a decent mid-priced hosting package that allows mod_rewrite and other basic services.
Then you won't have to put up with all the forwarding and dynamic IP silliness.

You may have good reasons to not have a domain name -- that's not my business, though. But otherwise, it seems to me that keeping a site running is a real pain with dynamic IPs, and you lose any possible "branding" that is a major benefit of a domain name. At some point, your time has got to count for something. When it does, a domain name and a real hosting account start to look reasonable.

Like I said, I don't judge (and won't tolerate it here), but I'd never use a dynamic IP setup for any long-term project.

Did that code fix work?

Jim

[RedScourge]

so far that i can tell it has worked, i understand what was wrong with it so im sure it works now, thanks.

the thing is though, i just dont wanna pay for such a service, its not that $30 a year is too much to ask, its that i dont really care, i kinda want a free site i can host off my computer so i can do things like run php code, and have access to my htpasswd file, my httpd.conf file, error+access logs, mySQL server, phpMyAdmin because i dont care about typing in DOS commands (yes, i use win32) (i use apache authentication because im too stupid at php so far, i dont know the whole security thing with writing php login scripts on my own, and i dont care to learn just yet, plus i use php4 so the majority of the php authentication scripts i have every downloaded free dont work at all)

the only thing i could do without in this whole thing i think is the apache access.log file because i have a php script i was able to actually write for myself that logs this stuff to a file, i also wrote a cheap counter script as well.

by the way, if i insisted on keeping my website hosted on my computer and bought a domain name, would i be easily able to point it to my computer, or would i have to run a DNS server too or something? i cant think of any possible way to make use of a purchased domain name unless i had a static ip, but thats not gonna be happening either apparently.

see the perfect solution would be using "no-ip"'s service that runs as a service in windows and automatically points the subdomain referral they provide me with to my ip address as soon as a change is detected, but my ISP blocks port 80 so i use another one.

is there any way i can get around my ISP blocking my port 80 that anyone knows of? so far "smartredirect" is the only service i can get that allows me to put in an ip address WITH a port number.

[RedScourge]

just to let you know a bit about my situation, i am running a super-small server on my personal computer that i use. i "use" this computer as my personal computer, and never shut it off, and i run a webserver and an SQL server off of it.

if i could run an email server so that my php function would work, i would, but i tried a few, like ArGoSoft Mail Server, but i cant get it to relay emails beyond my network.

the reason i cant use php's mail function with the email address my isp has provided me with is its passworded, and its POP3. if anyone knows of a way that i can run a local mail server that logs into my ISP's POP mail account and sends mail with it, that would help me alot, but i doubt this fits in this category.

if anyone is interested in how i manage to keep a webserver running on a celeron 366 tat is also used for personal use, without it crashing, i have a utility that clears my ram out so that my server doesnt get unbearably slow after a while.

due to the SUPER small amount of actual traffic to my site to date, me restarting this computer once a week or two suffices to keep it runnnig well, and nobody notices when its down. ive spent more downtime with this mod_rewrite screwing up my viewers access than i spend with my apache server not running.

all in all, i am certain that if i now get my php mailer function to somehow work, i could run a "real" website. and could host online games i make on it like i plan to do in the future.

all my webpages use relative links, so its not very hard for me to deal with the shifting ip addresses. they only change when i restart, so all i gotta do is go in my apache config, change my ip, change the ip on my rewritecond's, change the ip address in my various php programs like phpBB, and change the address my subdomain redirect service points to, and im set. takes about 2 minutes to do currently.

[RedScourge]

btw, i noticed this line was edited:

!^http://(www\.)?192\.***\.0\.1(:8080)?

i dont use a 192.*.*.* address, i use my actual ip address here, i dont have it set up in an internal network...but thats fine. i was worried i should hide my port number but i guess not if my address is hidden then.

[jdMorgan]

I don't know what your local costs would be, but you could look into colocation - basically, put your server into a room with an ISP's machines and other col-lo's. You could still log in remotely any way you like, but you'd have a fixed IP and a faster connection to the 'net, plus physical security and redundant power and cooling systems.

I guess if you're just using the home machine as a sandbox to play in while developing new stuff, it might not be worth the cost. But maybe worth looking into.

Jim