0

I would like to know the chances of not being able to access a website only through the domain name and denied of access through its direct IP address.

I wish draw attention to the following example, however the question is relevant to any other scenario: www.kickass.to website has the following addresses,

  • 67.212.88.146
  • 67.212.88.10
  • 205.204.64.122
  • 68.71.58.34

When I used the above, I received a message called “forbidden” but I can easily place the full URL and access the site.

Any domain address eventually converts to be an IP address by the browser as per my understanding. I am a little clueless here.

migrated from serverfault.com Feb 10 '15 at 5:19

This question came from our site for system and network administrators.

  • 1
    Why would you ever want to do that? Dynamic IP addresses might not be as common as the once were, but they are still around. – Mawg Feb 10 '15 at 10:22
4

Short Answer? Name-based virtual hosting allows IP address accesses to web servers to be treated differently from hostname accesses to the same web servers. And many web systems administrators “dead end” IP address accesses for basic security reasons. Additionally, “Forbidden” messages are not typically sent by IP address access being blocked; my gut tells me some web server firewall is detecting IP address access and stopping it dead in it’s tracks.

Longer Answer? While name-based virtual host setups like the one used in Apache allows multiple hostnames to use the same IP address, that—in and of—itself does not mean you will get a “Forbidden” if you are attempting to access a server via the raw IP address. That said, doing a curl -I to www.kickass.to shows that Nginx is being used:

HTTP/1.1 301 Moved Permanently
Server: nginx/1.7.8
Date: Tue, 10 Feb 2015 05:46:59 GMT
Content-Type: text/html
Content-Length: 184
Connection: keep-alive
Location: http://kickass.to/

While I refer to my experience with Apache—which is the most commonly used web server on the Internet—Nginx is gaining traction and allows for similar behaviors to Apache as I describe. Including being able to use ModSecurity. Read on for details; the same basic concepts apply to Apache and Nginx.

When I setup Apache servers with name-based virtual hosts, I do make a very conscious effort to create a “virtual moat” by having the default Apache config—often set as 000-default in the sites-enabled directory—to throw all non-hostname/IP-specific access to a literal blank HTML page. The logic being that many malicious pieces of software out there will attempt to “hack” a site by gaining access via the IP address. Why? Easy. Many Apache setups have a default “It works!” page setup at that address. Competent systems administrators will get rid of that page since robots/spiders out to hack a site will specifically look for that kind of “It works!” page as a basic clue that, “Hey! This administrator just tossed a server into production without really cleaning this basic stuff up. Let’s see what exploits can try on this server.” Believe it or not, but dead-ending the default Apache config is the simplest way to discourage unwanted accesses and DDoS attempts.

But like I said, a “Forbidden” doesn’t smell like an intentional “dead end” to me. Who knows, maybe the systems administrator did “dead end” the default Apache config into a completely dead or non-existent directory. But whenever I see “Forbidden” in a case like this, it makes me believe that the administrator has ModSecurity installed.

ModSecurity is an Apache web service level module that acts as a firewall between a web server and unwanted traffic. It uses “rule sets” to scan traffic in real-time—as the actual HTTP request is made—and if a pattern of access/behavior checks as “bad” it will throw up a “Forbidden” for that access. And in the case of raw IP addresses, one of the core rules in the ModSecurity core rule set (CRS) is to “Forbidden” any/accesses to RAW IP addresses.

So in my humble opinion, you are seeing a web server using ModSecurity—or a similar firewall tool—react to a raw IP request by just blocking the request entirely as “Forbidden.”

Additionally, you are stating that www.kickass.to has multiple IP addresses. That tells me some kind of load balancing is happening when requests are made to www.kickass.to. Anyone setting up a load balanced cluster will definitely make sure their child nodes are fairly bullet proof and inaccessible to unwanted requests. So exactly what I describe above, but even more so.

  • Server: nginx/1.7.8 Perhaps the server is actually nginx? – rakslice Feb 10 '15 at 6:07
  • @rakslice I mention Nginx in my answer as well as stating the general concepts are 100% the same. – JakeGould Feb 10 '15 at 6:08
4

Often, web servers are configured to use name-based virtual hosting, where the content that is served depends on the domain name that was requested in the Host header.

Name-based virtual hosting is necessary for almost all shared hosting, as well as for most web applications that use more than one domain name in their operation. As it is so frequently used, it is not unusual for it to be enabled even on a web server that only serves requests for a single domain name, whether for fancy domain name redirects, like this, or just due to organizational standards and/or an oversight by the admins.

More info:

This approach was developed to allow for web sites for different domain names to be hosted on the same web server. When you visit a site in a web browser, it sends a Host header with the domain name from the URL that it is attempting to load, and the server will send the content for the appropriate site.

e.g. browser sends:

GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.91 Safari/537.36
Host: www.kickass.to
Accept: */*

server replies:

HTTP/1.1 301 Moved Permanently
Server: nginx/1.7.8
Date: Tue, 10 Feb 2015 05:50:25 GMT
Content-Type: text/html
Content-Length: 184
Connection: keep-alive
Location: http://kickass.to/

<html>

[... snip ...]

(In this case the server has actually just sent me a redirect to http://kickass.to/ instead of a page at http://www.kickass.to/)

When you access the server using a URL with just the IP address of the server, the IP address will be sent in the Host header instead of a domain name.

GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.91 Safari/537.36
Host: 67.212.88.10
Accept: */*

If the server is configured for name-based virtual hosting, depending on the details of the configuration, it may serve you a particular site that is set as the default site to host at the IP address, or it may give you an error response.

HTTP/1.1 403 Forbidden
Server: nginx/1.7.8

[... snip ...]

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.