Permit access to URL based on IP address (restrict non-matching IP addresses)

escoles,

I would not go so far as to say that blocking by IP is pointless; it does add some security to the system, as the attacker must know what IP address to forge in order to get in. If the attacker can observe valid traffic to your site, though, the IP addresses being used can be determined, so this is "security by obscurity", but it does add some value.

[irrelevant ramblings deleted in favor of post below]

- Greg

First, let me explain a solution that is easy to understand, but doesn't quite work.

• Use the modules secure pages and secure pages hijack prevention
• Enable these two modules; this will redirect the login form to https
• Block port 443 at the firewall (only let in the IP addresses that are allowed to log in)

This is brilliant because it is simple to set up and it is completely secure. Its only flaw is that it doesn't allow unauthenticated users to use https. ubercart users might need https. If your payment system goes to another site (e.g. paypal) for the secure transactions, then you're done.

If you want to allow anonymous users to use https, I have another solution that is a little harder to understand, but still not too hard to set up. You can probably figure it out by yourself from the above hint (hint 2: use two virtual host configuration files with the same document root, run them on different ports, and include different rewrite rules in each. Block the port the second instance is running at via the firewall and leave the first on port 80/443 unblocked).

I'll be more verbose if necessary.

- Greg

Another thanks to chilledweb -- I was able to get that solution to work right off the bat, but what I needed was to allow an entire ip range. I already had cobbled this code together (actually not sure where the source came from anymore) and had it in place elsewhere on my site, so all I had to do was pretty much copy and paste.

What it does is call the start and end ip of the specified range, as well as the ip of the user, convert them all to numeric values, and compare them. If the user's ip is within the range, it prints the content, otherwise, it prints the restriction notice.

I wanted to keep my page theme, so instead of replace the entire node body, I inserted my script in the content div of my page, and used it to replace the standard print $content; command.

Replace x's with the start and end of your ip range

<div class="content">
<?php
$startip = "xxx.xxx.xxx.0";
$endip = "xxx.xxx.xxx.255";
$targetip = $_SERVER['REMOTE_ADDR'];

$startlong = ip2long($startip);
$endlong = ip2long($endip);
$targetlong = ip2long($targetip);

if ($startlong <= $targetlong AND $targetlong <= $endlong)
print $content; 
else print '<h2>Content Restricted</h2><p>Your custom content notice.</p>'; 
?>

</div>

Hope this helps others.