1

We are hosting a website locally. For this purpose, we have a public IP and corresponding DNS entry. We are using Apache 2.4 web-server. The website is publicly accessible without any problem. But website can also be assessed by proving public IP.

How can I avoid IP based public access of my website ? Should I update Apache (virtual host) configuration or where it should be handled ?

I know how to restrict client (IP) in Apache but my case is totally different.

Update: Example, https://www.contoso.com/ should work but https://203.0.113.66/ should not. This is what I want

  • Seems pretty clear to me - that is indeed the question OP is asking. – ResetACK Oct 10 at 8:00
  • The simple answer to the question is that you cannot prevent people from accessing your website via the IP address (for example I can access google by navigating to 216.58.199.36, and I get redirected to google.com), however you can redirect them to the FQDN using apache mod_rewrite - simply use three lines inside the VirtualHost serving the website: (1): RewriteEngine on, (2): RewriteCond "%{HTTP_HOST}" , and (3): RewriteRule ^(.*)$ http://www.domainname.com/$1 – ResetACK Oct 10 at 8:08
  • Isn't this the default situation? Do you actually have a certificate for 203.0.113.66? Normally you need to actively do something to allow HTTPS connections to the IP address. – AlexP Oct 10 at 8:27
  • 1
    @AlexP the client can always ignore the certificate error. But I don't see what the OP's goal is. Nice experience for users? Some sort of misguided anti-hacking step? OP: why do you need this? – muru Oct 10 at 8:29
  • If the name and address of your site is known, nothing prevents anyone to add its address to their /etc/hosts file (or equivalent) and access it by name even if its name isn't in any public DNS. Not speaking of forging the Host header in requests with suitable utilities. – xenoid Oct 16 at 8:26
1

You need to define a default vhost in your apache configuration. After that, define a vhost with the ServerName of the DNS name on which you want your website to be found.

Now requests with that name in the Host header will be handled by that vhost, and any other requests (with wrong or no hostname) will be handled by the default vhost (which should probably just be a page stating that a wrong host has been used, or similar).

If SSL (https) is being used, then requests to the IP address will get an SSL error anyway as the hostname (IP address in this case) does not match the hostname in the SSL certificate.

1

Using Ubuntu 18.04, Apache 2.4.29.

I think that there is a default vHost in apache2 i.e 000-default.conf. If your site is accessible through IP, you may have disabled this default configuration.

A work-around:

Edit 000-default.conf and put a redirect there.

nano /etc/apache2/sites-available/000-default.conf

In 000-default.conf

<VirtualHost *:80> Redirect / https://www.contoso.com/ </VirtualHost> <VirtualHost *:443> Redirect / https://www.contoso.com/ </VirtualHost>

Enable the configuration, if needed.

a2ensite 000-default.conf

Reload Apache2.

systemctl reload apache2.service

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.