Conditional 301 Redirect based on country

.. requests from a certain country should not redirect

[Imaster]

I have 301 redireced a domain A to another domain B, but now I want to implement on the server such that all requests to domain A from a certain country do not get redirected, instead they just show a 404 page or a blocked page.

I want that whenever someone accesses domain A from this certain country, instead of redirecting to domain B, all those requests should get blocked. Plus I don't want to block domain B from anywhere (including that country).

I succedded in blocking domain A using .htaccess file and feeding a list of IP addresses for that country, but the problem is that when a request comes to domain A, it first redirects to domain B, and then it gives the blocking message that I have provided.

I want to stop the blocking of the request at domain A directly, and not block it after it has been redirected to domain B.

I believe it doesn't work that way using .htaccess and I am trying to issue a block from httpd.conf, but haven't tasted sucess yet.

Any input would be appreciated.

[sitz]

This can be done with either .htaccess or httpd.conf, but there is a (fairly large) caveat (or two). If you're blocking access based on country of origin, you really only have two options: filter on hostname or filter by IP address:

Hostname:
=========

Pros:
-----

will get all hostnames in the country's top-level, regardless of the IP address

Cons:
-----

HUGE performance hit, as gethostbyaddr() must be called for EVERY incoming request.

Not all hosts in a particular country may be named with that country's top-level domain.

IPs in other countries could be named into the target country's namespace

IP address:
===========

Pros:
-----

No DNS lookup required to implement; very fast

Cons:
-----

Full list of IPs required to implement

Personally, I think that redirecting based on hostname is a non-starter; the overhead is just insane. The pain can be reduced, but not fully eliminated. I can go into detail on this if you'd like, but the short answer is that you run a caching-only nameserver on the host and configure that as your primary resolver. The nameserver will, over time, build up a cache of IP->name lookups.

Redirecting an entire country probably isn't 100% feasible. The actual feasibility will depend on which country you need to redirect. Want to redirect Denmark? Iceland? Ireland? You can probably get pretty close to 100%. Want to redirect the United States? Good luck with that; the number of IPs is too large, and I promise that some of them have been re-allocated to other countries.

If you know *some* of the IPs, you can find out which block they're allocated, and redirect based on that block. Additionally, there are tools online which a quick Googling [google.com] turned up, including [hostip.info ], which looks interesting. You might be able to integrate the downloadable version of that database into your application (or just extract the info on the country you want to redirect, and use that); Just be aware that the data in these sorts of databases...

probably isn't 100% accurate

will need to be updated regularly from a trusted source, since new allocations are made all the time.

As to the actual implementation; if you can get the IPs for the country in question, you can create a RewriteMap (see [httpd.apache.org ] for details). Something like this:

cat <<EOF>redirect.map
192.168.1. -
192.168.5. -
10.1. -
EOF

RewriteEngine on
RewriteMap ipmap dbm:/path/to/redirect.map
RewriteCond ${ipmap:%{REMOTE_ADDR}¦no-redir} ^-$
RewriteRule ^/(.*) http://www.example.com/$1 [L,R=301]

I'd strongly suggest following the RewriteMap docs with regards to using a DBM file over a txt file unless you only have up to a couple of hundred lines or so; linear scans through text files are not known for their speed. If you're running a high-traffic site, I'd suggest the DBM method anyway; creating it is trivially easy, and there's not really a huge /downside/ to using it.

I've undoubtedly forgotten a few dozen things in this (rather long) post; feel free to post follow-up questions. =)