We see that you are viewing the US version of our website from another country. If you would like to view a local version of our website, please click the link below...

Sales: 1-800-961-2888
Support: 1-800-961-4454
Login
  • MyRackspace Portal
  • Cloud Control Panel
  • Rackspace Webmail Login
Share this on:

How Do I Deny Certain IP Addresses From Accessing My Site on Cloud Sites?

Article Id: 106 | Cloud Sites | Article


On Cloud Sites, due to our unique hosting environment, we require a slight addition to the code used for the Allow/Deny feature. Basically the issue is that the requesting IP coming into a server is the IP of our load balancing server instead of the visitor's. This means limiting access on an IP level through .htaccess becomes problematic. The answer is that we provide an environment variable called X-Cluster-Client-Ip which has the visitor's ip.

In the .htaccess file containing your rules, place the following into your file:

Contents

Allowing only a certain IP/IP Addresses:

SetEnvIf X-Cluster-Client-Ip 000.000.000.000 allowclient
order deny,allow
deny from all
allow from env=allowclient

Allowing only a certain IP/IP Addresses when your site is using SSL:

SetEnvIf X-FORWARDED-FOR ^000.000.000.000$ allowclient
order deny,allow
deny from all
allow from env=allowclient

Replace 000.000.000.000 with your IP address. This will only allow your IP address to access your site, and is a great way to develop your site without restrictions.
You can repeat line 1 to allow multiple IPs.

Denying an IP/Multiple IP addresses:

SetEnvIf X-Cluster-Client-Ip "^000\.000\.000\.000" DenyAccess 
Order Allow,Deny 
Deny from env=DenyAccess 
Allow from all 

Denying an IP/Multiple IP addresses when your site is using SSL:

SetEnvIf X-FORWARDED-FOR "^000\.000\.000\.000" DenyAccess 
Order Allow,Deny 
Deny from env=DenyAccess 
Allow from all 

Replace 000\.000\.000\.000 with the IP address you want to deny. This will deny the IP address specified/multiple IP addresses (If you use multiple lines, as specified below).
You can repeat line 1 to deny multiple IP addresses.

Important note: Implementing this code may prevent images from loading on your cloud site. To address this you can add the following code do your .htaccess file:

<FilesMatch "\.(gif|jpe?p|png)$">
order deny,allow
allow from env=allowclient
</FilesMatch>
© 2011-2012 Rackspace US, Inc.

Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License


See license specifics and DISCLAIMER

Comments

Comment: 

If you want to block a CIDR based range, do this:

SetEnvIf X-Cluster-Client-Ip "000.000.000" DenyAccess

As opposed to

SetEnvIf X-Cluster-Client-Ip "000.000.000.0/24" DenyAccess

Comment: 

My above is partially correct, still having problems and that isn't the way to do it via this allow/deny style.

Comment: 

Is a configuration recommended so Apache logs client IP addresses (as without the load balancer) or PHP variables like $_SERVER['REMOTE_IP'] still work? It's preferable to add an Apache module to do this rather than update code in several places.

Add new comment

©2012 Rackspace, US Inc. About Rackspace | Fanatical Support® | Hosting Solutions | Investors | Careers | Privacy Statement | Website Terms | Sitemap