Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I used this tool to download list in ".htaccess allow" format to allow traffic from my country and restrict all others but it's still accessible when visiting from bunch of foreign proxies.

I'm restricting access to my home dev server where i certainly don't need traffic from China, Uganda, Russia and other countries i found while inspecting Apache logs.

Apparently, this format doesn't seem to work:

<Limit GET POST>
order deny,allow
allow from 37.18.184.0/22
allow from 37.18.188.0/22
allow from 37.19.104.0/22
allow from 37.19.108.0/22
allow from 37.35.8.0/22
allow from 37.35.12.0/22
allow from 37.35.64.0/22
allow from 37.35.68.0/22
allow from 37.77.168.0/22
allow from 37.77.172.0/22
deny from all
</Limit>
share|improve this question

migrated from serverfault.com Mar 11 '12 at 15:37

This question came from our site for professional system and network administrators.

    
What happens if someone in Russia uses a proxy within your country to connect? Or a VPN for that matter? –  Anagio Mar 11 '12 at 15:47
    
im positive that i or my dev environment are not that much interested to someone to take those steps to try harming me. im just trying to filter out script kiddies who slam my box every single day for some reason. –  purpler Mar 11 '12 at 18:16
    
denyhosts is a good script to automatically enter IP's into your hosts file and deny access when brute force SSH attempts are made. Mine is full of russina and chinese IP's. I occasionally get brute forces on FTP (vsftpd) and I manually enter those IP's as it's not often. I also like using a program called multitail to view multiple log files in real time in one terminal color coded for easy viewing. It's pretty nice check it out –  Anagio Mar 11 '12 at 18:53

3 Answers 3

From the information in your question, it's hard to say what might be wrong. I'd suggest starting with the following test:

  1. Write a simple script that echoes your IP address back, something like this (in PHP):

    Your IP address is: <?= $SERVER['REMOTE_ADDR'] ?>
    
  2. Visit the script from a foreign proxy, and note the address it reports. Compare the address to the Allow lines in your .htaccess file.

The results of this experiment should narrow down the possibilities a bit:

  • If the reported IP address doesn't match any of the Allow lines, then either Apache is not obeying your access controls at all for some reason, or there's another Allow line somewhere that's letting the request get through.

  • If the IP address does match one of the Allow lines, but appears to be the correct address of the proxy (try a reverse DNS lookup), then either your GeoIP database is wrong or the proxy is not located where you think it is.

  • If the reported IP address points to your own webhost, it may belong to a reverse HTTP proxy in front of your webserver. In that case, you'll need to figure out how to extract the real IP address of the client from the request headers (e.g. X-Forwarded-For) set by the proxy.

  • If the IP address reported by the script is your own, then either you didn't correctly configure your browser to use the proxy after all, or (unlikely) the proxy passed your IP address along in the request headers and, for some reason, your webserver is configured to blindly trust such headers (which is a bad idea — HTTP request headers are trivial to forge).

  • If none of the above hold, then something weird is going on. Doing a reverse DNS and/or WHOIS lookup on the reported IP address might help you figure out what.

Ps. You probably don't want to use <Limit> around you access controls, at least unless you really want to allow e.g. HEAD and PUT requests from any country.

share|improve this answer

Best way is use some existing of Apache-GeoIP tools (or modules)

share|improve this answer
    
MaxMind is really fast, the IP's are queried against a file you store locally rather than using an API connecting to a remote server like most other IP to Country API services. Using the file locally you can look up a lot of IP's quickly. This would be the best way if they wanted to check each IP connecting to their server. –  Anagio Mar 12 '12 at 19:56

Try with the netmask instead of the CIDR notation:

<Limit GET POST>
order deny,allow
allow from 37.18.184.0/255.255.252.0
...
allow from 37.77.172.0/255.255.252.0
deny from all
</Limit>

Alternatively do it like this:

<Limit GET POST>
order deny,allow
allow from 37.18.184.
allow from 37.18.185.
allow from 37.18.186.
allow from 37.18.187.
...
allow from 37.77.172.
allow from 37.77.173.
allow from 37.77.174.
allow from 37.77.175.
deny from all
</Limit>
share|improve this answer
    
tried, doesn't work for me. for some reason. :( –  purpler Mar 11 '12 at 18:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.