Forum Moderators: phranque
# These IPs are bad bots etc who should get a plain 403
deny from 66.199.231.202
deny from 216.40.224.6
deny from 68.56.204.23
deny from 71.124.157.69
<Files 403.html>
order allow,deny
allow from all
</Files>
# These (imaginary) IPs are the ones I want to deny and redirect to MESSAGE.html
deny from 12.345.67.89
deny from 98.76.54.32
deny from 67.89.0.
<Files MESSAGE.html>
order allow,deny
allow from all
</Files>
I've tried doing it like this but it still serves the second group a 403, so what am I doing wrong?
Both the .htaccess and MESSAGE.html file are in my www directory.
Why isn't it working?
Or am I going to have to use mod_rewrite?
I already tried this (tagged onto the end of my current mod_rewrite conditions), but it did nothing:
Options +FollowSymLinks
RewriteEngine on
# Other conditions
RewriteCond %{REMOTE_ADDR} 12\.345\.67\.89 [OR]
RewriteCond %{REMOTE_ADDR} 98\.76\.54\.3 [OR]
RewriteCond %{REMOTE_ADDR} 67\.89\.0\.
RewriteRule /MESSAGE.html [NC,L]
# Other conditions
RewriteCond %{REMOTE_ADDR} 12\.345\.67\.89 [OR]
RewriteCond %{REMOTE_ADDR} 98\.76\.54\.3 [OR]
RewriteCond %{REMOTE_ADDR} 67\.89\.0\.
RewriteRule !^MESSAGE\.html$ /MESSAGE.html [NC,L]
Many thanks Jim.
And I thought I was beginning to understand mod_rewrite... *chuckle*
You need to add anchoring to those IP addresses, otherwise, they are ambiguous. For example, the first one would also ban 112.345.67.89 or 212.345.67.89. Fully-anchor only single IP addresses, and don't end-anchor ranges such as your last one.
# Other conditions
RewriteCond %{REMOTE_ADDR} ^12\.345\.67\.89$ [OR]
RewriteCond %{REMOTE_ADDR} ^98\.76\.54\.3$ [OR]
RewriteCond %{REMOTE_ADDR} ^67\.89\.0\.
RewriteRule!^MESSAGE\.html$ /MESSAGE.html [NC,L]
Ta!
But it leaves this error log message:
mod_rewrite: maximum number of internal redirects reached. Assuming configuration error. Use 'RewriteOptions MaxRedirects' to increase the limit if neccessary.
Is this acceptable, or do I need to modify the mod_rewrite code?
Be very careful about the syntax of that RewriteRule. It must be exactly as I posted it above in message 2 with a space after RewriteRule. Then "!^" then the MESSAGE\.html filepath with no leading slash, then the "$", then a space, and the the path to MESSAGE\.html again, but with a slash.
The rule is supposed to prevent looping itself; It says, "If the requested URI is NOT exactly MESSAGE.html, then (assuming the above conditions have been met) internally rewrite to /MESSAGE.html and quit processing for this pass."
Therefore, if the paths don't match (with the exception of the leading slash mentioned above and the escaped period in the pattern), the rule will loop, and you'll get the result you're seeing.
Adding to our troubles, the forum deletes spaces preceding "!" unless you type two spaces.
Jim
I wonder if it something to do with the way I've combined it with the rest of my RewriteCond?
It's all been working solidly for months, I just tagged this onto it.
Here's how I end my block in the www .htaccess.
(I've disguised the IPs before posting here)
Options +FollowSymLinks
RewriteEngine on
Lots of good stuff here...
RewriteCond %{HTTP_REFERER} iaea\.org [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailCollector [OR]
# google prefetch Kill that WebAccellerator, Claus
RewriteCond %{X-moz} ^prefetch
RewriteRule .* - [F]
RewriteCond %{REMOTE_ADDR} ^123\.456\.7\.89$ [OR]
RewriteCond %{REMOTE_ADDR} ^987\.65\.43\. [OR]
RewriteCond %{REMOTE_ADDR} ^321\.123\.45\. [OR]
RewriteCond %{REMOTE_ADDR} ^213\.12\.123\.
RewriteRule !^message\.html$ /message.html [NC,L]
I've had it up for two days now, the recalcitrants have visited and seen the message, so I can change it to a plain 403, now that they've got the message. But I know we'd both like to get this right for future reference.
Without looking at the access log and error log for the 'loop', I can't really see anything else wrong.
If you use a custom 403 page, you need to exclude its filename from any [F] rules, otherwise the server will generate a 403 because you told it to, and then get another 403 trying to server the custom 403 page. But this is probably not the immediate problem you're seeing. Any logs?
Jim
664 is the size of the message.htm file. And when I block my own IP I do indeed get served the message.htm file in the browser, so I know it is working, despite the loop.
123.456.7.89 - - [16/Feb/2006:06:50:36 -0500] "GET /example.filename.htm HTTP/1.1" 200 664 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
[Thu Feb 16 06:50:36 2006] [error] [client 123.456.7.89] mod_rewrite: maximum number of internal redirects reached. Assuming configuration error. Use 'RewriteOptions MaxRedirects' to increase the limit if neccessary.
Jim
I have subdomains and putting this .htaccess file in root caused problems of some kind, can't recall what.
I'll try moving just the message.html file to root and see what that does.
Not to worry though, the main objective has been achieved.
When I said 'root' I meant the Web-accessible root folder defined as DocumentRoot, the same place where your 'home page' and robots.txt are located.
Jim
There's a folder below this one that my host calls 'root' it has the cgi-bin and non public stuff. I put a copy of the message.html file in there too to see if it stops the looping, but the target IP hasn't returned since, so I don't know.
But I'm happy enough, thanks.
