Rewrite based on Referer and Remote Address

Unsure of correct syntax

[bcolflesh]

Say I have a User Agent blocked, ex:

RewriteCond %{HTTP_USER_AGENT} ^Wget [OR]

But I also have a condition to allow requests from my domain, ex:

RewriteCond %{HTTP_REFERER}!^http://(.*).mydomain.com/.*$ [NC]

How would I prevent users of tools like Wget from changing the referrer to mydomain.com to bypass the rewrite - can I specify the acceptable Remote Address of the Referer in the same line, something like:

RewriteCond %{HTTP_REFERER}!^http://(.*).mydomain.com/.*$ ¦ %{REMOTE_ADDR} ^0.0.0.0 [NC]

[jdMorgan]

No, for two reasons.

First, {REMOTE_ADDRESS} refers to the IP address of the client and not the referrer, and second, your RewriteCond is syntactically incorrect -- all envars must be on the left side of the RewriteCond.

If your WGET blocking rewrite precedes the referrer check in your code, then WGET will be blocked regardless of the referrer, so there is no problem here. If WGET is still able to access your site, then the problem lies in the existing code, not in code that is missing and needs to be added.

Jim

[bcolflesh]

Then it must be a problem w/the existing code, which is:

RewriteCond %{HTTP_USER_AGENT} ^Wget [OR]
RewriteCond %{HTTP_REFERER}!^http://(.*).mydomain.com/.*$ [NC]
RewriteRule \.(gif¦jpg)$ - [NC,F]

[jdMorgan]

Nope, nothing wrong there that would allow Wget to have access, although the referrer pattern can be improved a bit.

RewriteCond %{HTTP_USER_AGENT} ^Wget [OR]
RewriteCond %{HTTP_REFERER} !^http://(.*)mydomain\.com/ [NC]
RewriteRule \.(gif¦jpg)$ - [NC,F] 

Do you have any preceding rules that would prevent this code from being executed? Do you have other rewrite rules that are working?

Jim

[bcolflesh]

Weird - I'll have to play with it when I can - also, escaping the period in your changed example, is that necessary?

[jdMorgan]

Is it neccessary? No, just more specific, and therefore less prone to spoofing. An unescaped period in a pattern matches any single character.

There are all sorts of things that can cause a rule not to be processed. For example, if you have missing closing parentheses, curly-braces, or square brackets, or an [OR] on the *last* RewriteCond of a RewriteRule that precedes the one that doesn't work. Or it may be that your expectations don't match your code; For example, your rule will stop Wget or referrals from unathorized sites from fetching images (.gif and .jpg), but not pages (.html).

Jim

[bcolflesh]

Thank you for all your help!