Forum Moderators: phranque

Message Too Old, No Replies

Allow access to example.com but disallow access via its dedicated IP

         

Angonasec

2:21 am on Mar 9, 2014 (gmt 0)



FreeBSD on Apache 2 Shared hosting:

I recently moved our main site to a new host with a fresh dedicated IP.

I own eight other related (.tld variations) but parked domains, which are now sharing this same IP.

I am developing those for subsequent use, not to redirect to the main site.

How do I safely stop all attempts to access the main domain by numeric IP?

ie. Allow access by www.example.com but disallow by nnn.nn.nn.nn

lucy24

11:58 am on Mar 14, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



This is a rule to block access.

To allow access by this IP, the pattern for %{REMOTE_ADDR} should be start and end anchored and the whole thing preceded by ! for NOT.

Whoops! Uhm, er, yes. "When the visitor is NOT me..."

Angonasec

12:24 pm on Mar 14, 2014 (gmt 0)



I think g1smd is enjoying watching us squirm our way through this one... :)

But we're not giving up that easy Sir!

Light's gradually beginning to filter through, and I glimspe the possibility that, what I thought was a generic Condition, is in fact the literal code to use: ie.

RewriteCond %{HTTP_HOST} ^\d+\.\d+\.\d+\.\d+$

I may just try it before you reply...

Why didn't somebody tell me Regex is this much fun?

Angonasec

12:30 pm on Mar 14, 2014 (gmt 0)



Bingo! :)

lucy24

8:21 pm on Mar 14, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



The reason you can use \d\. et cetera as-is is that nobody will reach your server in the first place unless they're using your current IP address. Well, maybe if you're in Unsecured Proxy territory, but for that you need someone who speaks Apache. Generally if it's a number, it has to be your own number.

The universal RegEx locutions are
\d = any digit 0-9, so same as [0-9]
\s = any space, which in Apache should only mean ordinary " " spaces
\w = "word character", meaning alphanumerics plus _ (lowline) but not hyphen

Many RegEx dialects support other formulations. But there's no simple way of saying [A-Za-z] in Apache. My text editor says \p{Alpha} but every dialect uses a slightly different form. I can also say things like \p{Greek} or \p{CanadianAboriginal} which are useful in text editing but generally not needed in Apache. If you had, say, URLs in Arabic, you'd need grouping brackets instead.

When I started working with Regular Expressions a bit over 9 years ago, I was deathly afraid of them. This is the natural and proper way to feel; you can seriously injure yourself with a carelessly applied RegEx. It took me about a year to even progress from text searching to active replacing. And that's in text editing, where you can always find the backup and start over again.

Edit: (Hmm, 2:16, I think I'm just squeaking under the wire.) Didn't I just get through saying that \w in practice means " " in Apache? I just met a robot in yesterday's logs who requested

/ebooks/paston/paston2.html%0D%0A


thus playing havoc with my log-wrangling functions. I looked it up to confirm that 0D and 0A are CRLF, alias \r\n, aka a Windows line break. Grr. And meanwhile there's a parallel thread about requests with appended garbage after ".html" ...

Angonasec

1:50 am on Mar 15, 2014 (gmt 0)



We're all cheering you on Ma'am, as you train for the Regex Olympics.
This 35 message thread spans 2 pages: 35