On Cloud Sites, due to our unique hosting environment, we require a slight addition to the code used for the Allow/Deny feature. Basically the issue is that the requesting IP coming into a server is the IP of our load balancing server instead of the visitor's. This means limiting access on an IP level through .htaccess becomes problematic. The answer is that we provide an environment variable called X-Cluster-Client-Ip which has the visitor's ip.
In the .htaccess file containing your rules, place the following into your file:
Contents
|
SetEnvIf X-Cluster-Client-Ip 000.000.000.000 allowclient order deny,allow deny from all allow from env=allowclient
SetEnvIf X-FORWARDED-FOR ^000.000.000.000$ allowclient order deny,allow deny from all allow from env=allowclient
Replace 000.000.000.000 with your IP address. This will only allow your IP address to access your site, and is a great way to develop your site without restrictions.
You can repeat line 1 to allow multiple IPs.
SetEnvIf X-Cluster-Client-Ip "^000\.000\.000\.000" DenyAccess Order Allow,Deny Deny from env=DenyAccess Allow from all
SetEnvIf X-FORWARDED-FOR "^000\.000\.000\.000" DenyAccess Order Allow,Deny Deny from env=DenyAccess Allow from all
Replace 000\.000\.000\.000 with the IP address you want to deny. This will deny the IP address specified/multiple IP addresses (If you use multiple lines, as specified below).
You can repeat line 1 to deny multiple IP addresses.
Important note: Implementing this code may prevent images from loading on your cloud site. To address this you can add the following code do your .htaccess file:
<FilesMatch "\.(gif|jpe?p|png)$"> order deny,allow allow from env=allowclient </FilesMatch>

Comments
Block CIDR Range
If you want to block a CIDR based range, do this:
SetEnvIf X-Cluster-Client-Ip "000.000.000" DenyAccess
As opposed to
SetEnvIf X-Cluster-Client-Ip "000.000.000.0/24" DenyAccess
Followup to CIDR
My above is partially correct, still having problems and that isn't the way to do it via this allow/deny style.
Is a configuration
Is a configuration recommended so Apache logs client IP addresses (as without the load balancer) or PHP variables like $_SERVER['REMOTE_IP'] still work? It's preferable to add an Apache module to do this rather than update code in several places.
Add new comment