Apache2 access restricted to local LAN

Question

Until recently, I had a bunch of virtual sites set up like so:

<VirtualHost 127.0.0.1:1234>
    ...

This works fine for testing on my local machine, where I use a Linux desktop. In order to test how MS and explorer displays my pages from my Windows laptop, I changed this to

<VirtualHost *:1234>
    ...

Which also works fine, calling the site up from http://[mylinuxservername]:1234 on my laptop's IE. However, I want to restrict that wildcard to the local lan. Plugging in any ip, like 192.nnn.nnn.nnn or 192.*.*.* where the wildcard is above results in 403 Forbidden on the windows machine. The local server still works fine on my Linux box:

<VirtualHost 127.0.0.1:1234 192.*.*.*:1234>
    ...

or

<VirtualHost 127.0.0.1:1234 192.nnn.nnn.nnn:1234> #exact IP of laptop
    ...

Anyway, I don't like that wildcard in the second config example above. Hints anyone?

Answer 1

Belongs on serverfault, but whatever:

The parameter(s) of <VirtualHost are the local addresses you listen to, not the remote ones.

You are looking for authz_host configuration:

Order Allow,Deny
allow from 127.0.0.0/8
allow from 192.168.0.0/16

Answer 2

Use iptables to restrict access to the machine itself. The first command will allow HTTP traffic from any network in the 192 range (note that I think you need 192.168 to truly be local but I could wrong). The second command simply drops packets from other sources for port 80

iptables -I 1 INPUT -s 192.0.0.0/8 -p tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT


iptables -I 2 INPUT -p tcp --dport 80 -m state --state NEW -j DROP

Then in your virtual host you can do <VirtualHost *:80>

Answer 3

Jack,

The /8 and /16 are lengths of the subnet mask. It's CIDR Notation