Allow request coming from specific IP only

Question

I have application hosted Apache UNIX, and I am allowing users to access the application url from citrix environment (from citrix machine).

However, currently its possible to access the url from all the connected machines. I would like to put the restriction that it should be only accessed from citrix machine. So if any one needs to access it, he needs access to citrix machine.

I tried with below:

<Directory /APP>

    Order Deny,Allow

    Deny from all

    Allow from 160.120.25.65

    Allow from 127

</Directory>

it didn't work. Any suggestion?

Few replied with iptables solution, however this one loaded on Solaris (it doesn't have builtin firewall to OS as linux).

Answer 1

I would probably use an iptables rule for this. I'm not sure what the example you posted is, but you should be able to configure just about any firewall to work like you want it.

Answer 2

You could use IIS to filter IP's also. This article might help you.

http://www.15seconds.com/Issue/011227.htm

Answer 3

What version of Apache are you running? The IP allowing mechanisms are, AFAIK, provided by mod_authz_host, which was introduced in 2.2 (well, 2.1 technically). If you do have 2.2, make sure it wasn't compiled with mod_authz_host disabled.

Generally speaking, though, you may find a simpler and more robust solution is the iptables or other firewalling suggested in the other answers.

Answer 4

This should do what you need:

<Directory /APP>

    Order Allow,Deny

    Allow from 160.120.25.65
    Allow from 127.0.0.0/8

</Directory>

See the mod_authz_host documentation for details.

Answer 5

I would suggest Iptables for this purpose. put a rule in the iptables that wherever the destination port is the port number of your apache machine and the source ip is the ip address of critix machine, the linux machine should drop that packet. This way would solve your problem provided there are no other applications hosted on the apache of your machine which ought to be open for all ips. An example of the perspective rule could be :-

iptables -I INPUT 1 -s 160.120.25.65 -d <port_of_apache_on_your_machine> -j DROP

This should solve your problem, once you replace by its proper value