Sign in Register
Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Connie DeCinko 931 posts 1160 karma points
    May 10, 2016 @ 21:36
    Connie DeCinko
    0

    URL Rewriting to restrict by IP not working

    Trying to prevent access to a specific page in Umbraco via URL rewrite as this article describes: http://www.attackmonkey.co.uk/blog/2014/03/using-url-rewriting-to-restrict-access however it's not working. I even set it to block the entire site yet I can still access it. Is something in Umbraco blocking it?

    <rewrite>
    <rules>
        <rule name="Restrict Access to Status Page" stopProcessing="true">
            <match url=".*" />
            <conditions>
                <add input="{REMOTE_ADDR}" pattern="123.123.123.123" />
            </conditions>
            <action type="CustomResponse" statusCode="503" subStatusCode="0" statusReason="Page is unavailable" statusDescription="You do not have access to this page." />
        </rule>
    </rules>
</rewrite>
    Copy Link
  • Nicholas Westby 2054 posts 7104 karma points c-trib
    May 10, 2016 @ 21:40
    Nicholas Westby
    0

    Are you testing this from your local? Localhost IP's look a little different. Something like ::1 (can't remember if it's exactly that, but it's a little funky looking).

    By the way, looks like you aren't escaping your periods in the pattern for the IP address. If you don't do that, they'll match any character rather than just periods.

    Copy Link
  • Connie DeCinko 931 posts 1160 karma points
    May 10, 2016 @ 21:49
    Connie DeCinko
    0

    Testing on my dev server. I've seen several examples with and without the slash before the period. Does not seem to make a difference. Even tried negate and I can still see the page.

    <add input="{REMOTE_ADDR}" pattern="172\.30\.6\.10" negate="true" />
    Copy Link
  • Nicholas Westby 2054 posts 7104 karma points c-trib
    May 10, 2016 @ 21:54
    Nicholas Westby
    0

    I've noticed that IIS (or IIS Express) seems to be very aggressive in caching rewrite rules. Maybe try a restart?

    Also, it would be worth creating a test page (or use an existing page) to output the current remote address. Maybe it's doing something unexpected (e.g., an IPv6 format address).

    Copy Link
  • Connie DeCinko 931 posts 1160 karma points
    May 10, 2016 @ 21:57
    Connie DeCinko
    0

    I tried a different server value and that works:

    <add input="{HTTP_HOST}" negate="true" pattern="localhost" />

    Just cannot get it to work with an IP.

    Copy Link
  • Nicholas Westby 2054 posts 7104 karma points c-trib
    May 10, 2016 @ 22:09
    Nicholas Westby
    0

    You may want to try ::1: http://serverfault.com/a/238104

    Or see exactly what the HTTP header is for REMOTE_ADDR. Should be something like Request.Headers["REMOTE_ADDR"].

    Copy Link
  • Connie DeCinko 931 posts 1160 karma points
    May 10, 2016 @ 22:35
    Connie DeCinko
    0

    I may have that working, but now I cannot get it to work for a specific Umbraco page:

    <match url="^/securitynotices/(.*)" />

    I wonder if this will not work since the page does not exist on the file system?

    Copy Link
  • Connie DeCinko 931 posts 1160 karma points
    May 10, 2016 @ 23:15
    Connie DeCinko
    0

    Here is the rule I ended up with. It seems to work, hopefully it's accurate. I see that the redirect must be a permanent as you have to delete your cookies to retest.

        <rules>
        <clear />
        <rule name="Restrict Access to Security Guard Page" stopProcessing="true">
            <match url="^securitynotices*" />
            <conditions>
                <add input="{REMOTE_ADDR}" pattern="^172\.30\.6\.*" negate="true"/>
            </conditions>
            <action type="Redirect" url="/Search" />
        </rule>
    </rules>
    Copy Link

  • This forum is in read-only mode while we transition to the new forum.

    You can continue this topic on the new forum by tapping the "Continue discussion" link below.

Please Sign in or register to post replies