Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do I block access from some IP address (not to)?

I have an Apache/CentOS 6 web server running a few minor family sites from my house with a dynamic IP address updated with Namecheap's DNS client. I don't want people to be able to punch my IP address into their browser and get my default site. However, I need for it to work as it does now, without changing the way my family connects to it, to avoid a myriad of support calls from my uncle, aunts, grandmothers, mom, sister, nephews, etc. about why their shortcut isn't working.

I have my IP address configured as a vhost to send requests to a null folder showing the default Apache index file, but I want to hide the fact that there is a web server there at all for IP address requests. How should I configure Apache or .htaccess to completely drop or refuse (whichever would keep people from digging deeper) people that use my IP address in their browser?

My reasoning is: I don't want to go to a porn site and have someone - site admin, script kiddie, malware person, whoever - get my IP address, punch it into their browser, and get pictures of my family and dog. "Oh, Sol LastName - lives in Random Town, FL. Works for Company X making widgets. Has a wife and 7 kids, all of whom are pictured and named. Likes big-booty pregnant dwarves in sheep costumes, singing in Yiddish. Sending a message directly to his wife (cross-referenced with Facebook) with suggestions on how to wear sheep costumes more provocatively sounds like fun!"

Or random script kiddie gets mad because I dissed Faygo on their forum. Puts my IP address into their browser, finds my site, my name, general information about my family, decides to post to a local town forum that Sol LastName is looking for eligible bachelors to go down on. Need I go on?

share|improve this question
    
What is the purpose of hiding the fact there is a web server on your ip address. You do understand your domain exposes this information. –  Ramhound Jun 19 '13 at 12:58
    
"I don't want people to be able to punch my IP into their browser and get my default site." –  Sol of All Weapons Jun 19 '13 at 14:43
    
I do other things from this IP, like watch porn and post scathing comments about lolcats and make snarky fun of people in walmart. I don't want people to be able to get my IP, hit my site and make snarky fun of of my family pics, or send porn logs to my wife, whatever. I know that this will still be possible but I want to hide this fact from casual inspection. –  Sol of All Weapons Jun 19 '13 at 14:58
    
I understand what you want to do. But you won't be able to "hide the fact that there is a web server" because they can determine that from the fact there is a domain connected to your address. –  Ramhound Jun 19 '13 at 15:03
    
I'm not understanding how they will know this from just getting my IP, putting it into their browser, and getting no response. They don't know my domain names, and if I can make this happen, they will have no reason to think there are any. As of now, they WILL know because an Apache index.html says, "Welcome to your Apache install!", which means there is something there and they should keep looking. –  Sol of All Weapons Jun 19 '13 at 15:10

1 Answer 1

up vote 0 down vote accepted

You can't hide completely that there is a webserver there, since the connection to the server is made with the IP address, and not the hostname. Apache then reads the request, which contains a Host field indicating the IP that was used to access this site, but by that time, the TCP connection is already established. You may however use mod_security to close the TCP connection once apache has found the correct vhost without sending an HTTP reply, see http://serverfault.com/questions/401517/how-to-drop-all-requests-using-mod-security.

Also, make sure that the vhost you use to drop those requests is the first vhost apache reads in its configuration, as that will be the one chosen if no vhost match (for example, if someone uses their hosts file to give a random name to your IP address).

share|improve this answer
    
Thank you, user2313067. Exactly what I was looking for. –  Sol of All Weapons Jun 19 '13 at 21:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.