.htacces Help Needed

[Giljorak]

I have found the following entries in my access_log several times the IP's belong to Webcontent International. I do not want them on my sight because they ingore robots.txt.

65.102.12.225 - - [27/Sep/2003:10:17:50 -0600] 0 "GET /index.php HTTP/1.0" 302 309 "- -> /index.php" "Mozilla/4.0 (compatible; MSIE 4.0; Windows 95)"
65.102.23.161 - - [27/Sep/2003:10:18:02 -0600] 0 "GET /Forums/ HTTP/1.0" 302 309 "- -> /Forums/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
65.102.23.169 - - [27/Sep/2003:10:18:08 -0600] 0 "GET /Forums HTTP/1.0" 302 309 "- -> /Forums" "Mozilla/4.77 [en] (X11; U; Linux 2.2.19 i686)"

I run my own server with Apache 2.0.47 and PHP 4.3.3 running on RH7.3. My problem is that I can't keep the above IP addresses from hitting my site using mod_rewrite. There are other IP's that belong to them but these are the ones that keep coming back. I have tried the following mod_rewrite commands to no avail:

RewriteCond %{REMOTE_ADDR} ^65\.102\.12\.225 [OR]
RewriteCond %{REMOTE_ADDR} ^65\.102\.23\.161 [OR]
RewriteCond %{REMOTE_ADDR} ^65\.102\.23\.169
RewriteRule!^.*403\.php$ - [F,L]

-OR-

RewriteCond %{REMOTE_ADDR} ^65\.102\.12\.2(2[4-9]¦3[01]) [OR]
RewriteCond %{REMOTE_ADDR} ^65\.102\.23\.1(5[2-9]¦6[0-9])
RewriteRule!^.*403\.php$ - [F,L]

I have other items in my .htaccess file. I know mod_rewrite works because I can block my own IP without a problem using either of these statements:

RewriteCond %{REMOTE_ADDR} ^xx\.102\.xxx\.2[0-5][0-9]
RewriteRule!^.*403\.php$ - [F,L]

RewriteCond %{REMOTE_ADDR} ^xx\.102\.xxx\.
RewriteRule!^.*403\.php$ - [F,L]

What am I doing wrong? Any ideas?

Thanks,
Tim

[closed]

Try putting a space between RewriteRule and !.

[Giljorak]

There is a space between them. It just looks like there isn't one with the way this forum displays it.

[closed]

Oh. Sorry.

Your mod_rewrite commands look okay.

You may have to show more of your .htaccess. From the lines of the log file you showed above, it looks like your visitors are being redirected somewhere.

While we're looking at your log file entries, you wouldn't happen to know what the stuff in the quotation marks is supposed to be, would you? For example:

"- -> /Forums"

Is "-" the referrer?

[Giljorak]

It comes from my logformat setup in httpd.conf:

LogFormat "%h %l %u %t %T <br>\"%r\" %q %>s %b \"%{Referer}i -> %U\"<br> \"%{User-Agent}i\"" combined

I pulled the <br> out from the above post because I didn't how the boards would handle it.

Here is what the full line looked like:
65.102.12.225 - - [27/Sep/2003:10:17:50 -0600] 0 <br>"GET /index.php HTTP/1.0" 302 309 "- -> /index.php"<br> "Mozilla/4.0 (compatible; MSIE 4.0; Windows 95)"

I created my own log parser and I put those items in to help format the output easier. The log parser is written in shell and creates custom html files so that I can look through the days hits and call other custom php files(via embedded links)to learn more about the ip or to even ban them using a SetEnvIf Remote_Addr appended to the top of my .htaccess file.
I try to use the mod_rewrite commands for larger blocks of ip's and the SetEnvIf commands for singles.

yes - is referer.
Sorry for the confusion.

Thanks,
Tim

[closed]

Okay. Thanks for the info. I usually see the common logfile format, so that kind of threw me.

Now, back to your problem. It looks to me like there are some other rules that are being applied, so I'd have to learn more about your .htaccess.

Could you give me more details about the "other items" you mentioned that are in your .htaccess?

[Giljorak]

closed thank you for helping me investigate this. I sent you a sticky mail with the contents of my .htaccess file.

[closed]

Thanks, Tim.

Your .htaccess looks okay. Nothing really suspicious about it.

I still don't understand why visitors get the 302 status code. Is that redirect in httpd.conf? I may have to see that file too.

[Giljorak]

I sticky mailed you my httpd.conf file.

Thanks again for your help.

Tim

[closed]

I think we'll stick to sticky mailing each other first.

Hey, it took a few minutes for me to compose that sentence. ;)