Ban by IP and auto redirect to HTTPS

vanowm

1/15/24, 2:53 PM

I'm trying to block access to the website for certain IP addresses. For this I have a file ipblacklist.conf with list of IPs in the following format one line per IP:

Require not ip xxx.xxx.xxx.xxx

Then in the httpd.config I have this:

<Location />
   <RequireAll>
      Require all granted
      Include ipblacklist.conf
   </RequireAll>
</Location>

This works fine; however, I also have automatic redirect to https with the help of mod-rewrite, at the end of httpd.config:

RewriteEngine On
RewriteOptions InheritDown
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Both of these features work fine, however, when I visit http page from banned ip, it doesn't show 403 error right the way, it first redirects to https then it shows 403. Is there a way avoid redirection banned IPs to https

168

1 + 2

mod-rewrite

apache-2.4

Zareh Kasparian

1/15/24, 4:42 PM

Modify your RewriteCond to check the IP address against the map before redirecting to HTTPS

Esa Jokinen

1/15/24, 5:08 PM

Using mod_rewrite for this is rather inefficient. I would use mod_alias for a simple HTTP to HTTPS redirect and place the blacklist on the HTTP configuration, too.

Score:1

Server

Zareh Kasparian

1/15/24, 4:52 PM

Something like below might help.

In your httpd.conf file, add the following lines to create the map:

RewriteMap ipblacklist txt:/etc/ipblacklist.txt

Modify your RewriteCond to check the IP address against the map before redirecting to HTTPS:

RewriteCond ${ipblacklist:%{REMOTE_ADDR}} !=1
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

In the example I provided, %{REMOTE_ADDR} is used as an argument in the RewriteMap to check the client's IP address against the banned IP addresses in the ipblacklist.txt file. If the IP address is found in the map, the condition ${ipblacklist:%{REMOTE_ADDR}} !=1 is true and the request is not redirected to HTTPS, instead it will shows the 403 error.

+ 1

vanowm

1/15/24, 5:22 PM

Thank you. This seems to work, unfortunately it requires to have and maintain 2 different lists. Unless do the 403 error via mod-rewrite itself. Either way, the server would have to check ip twice for each request...

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Ban by IP and auto redirect to HTTPS

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.