Note: this question is about the built-in OpenBSD http server named httpd and its configuration. It does not apply to any other web servers.

Is it possible to make runtime conditional configurations of the new OpenBSD http server httpd? A naïve example would be

server "myserver.com" {
  if $REMOTE_ADDR == "" block drop

to disallow local access.

Another, perhaps more relevant and illuminating, example would be in the case I am implementing an interface to a remote service that runs from a specific place, then I would benefit from something like

remote_service1_ip = ""
server "myserver.com" {
  location "/remote_service1_api/" {
    if $REMOTE_ADDR != $remote_service1_ip block drop

If this is possible, what is the correct way of doing it?

More generally - there are a number of predefined macros specified in the man-page of OpenBSD-httpd.conf as described in the block:

    The request path.
    The optional query string of the request.
    The IP address of the connected client.
    The TCP source port of the connected client.
    The remote user for HTTP authentication.
    The request path and optional query string.
    The configured IP address of the server.
    The configured TCP server port of the server.
    The name of the server.
    The capture index n of a string that was captured by the enclosing location match option.

and I would like to know how to use them. Using $REMOTE_ADDR in a redirection context seems rather silly to me, and I guess there should be something else to use them for, but I can't find or understand any such use case in the documentation.

  • What are you trying to do, exactly?
    – Alex Holst
    Commented Apr 8, 2016 at 21:47
  • Thank you for your comment. I have updated the question with the specific case and the general one.
    – Bex
    Commented Apr 10, 2016 at 12:01

1 Answer 1


while httpd supports using patterns in the context of some keywords (alias match, location match, server match) the functionality you are looking for is not implemented in httpd.

i see two ways to realize your intentions:

  1. crosspost on the openbsd-misc mailing list - one of the authors of httpd might pick you up there
  2. use pf to firewall. i do strongly recommend this way for various reasons including
    • higher grade of protection against denial-of-service types of attacks as the application (httpd) does not have to take any load
    • packets from clients can be inspected and blocked on a global (IP) wide level - i.e. a flooding client may not connect to the ssh port

i my opinion, pf can be a very satisfying thing to learn.

besides, i suspect a possible answer to an according post on openbsd-misc to be similar to my recommendation :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .