0

Quick explanation:

  • Home hobby server
  • Some public services, some I'd like to restrict to internal only
  • Since I discovered reverse proxies () I've been migrating everything behind subdomains of my domain, via Apache
  • I then discovered that I could no longer simply use Require local as before, since Apache always sees the public IP address of the client
  • Require forward-dns appears to be the solution I want, however it's not giving the expected result
  • I'm on a dynamic IP, but the results seem like they should be broadly correct. I just want to understand why this isn't working

Example .htaccess on the server (as an initial test):

Require forward-dns mydomain.biz

Example public IP test from within my home network:

$ host myip.opendns.com resolver1.opendns.com

... myip.opendns.com has address a.b.c.d ...

Lookup the domain name:

$ host mydomain.biz

mydomain.biz has address a.b.c.d

mydomain.biz mail is handled by 10 mydomain.biz

However, upon accessing the site from the local network:

[Thu Aug 09 12:59:35.478812 2018] [authz_core:error] [pid 18478:tid 139675020785408] [client a.b.c.d:45860] AH01630: client denied by server configuration: /var/www/blah/blah/

So even though authz_core receives the expected IP, its forward-dns server does not return that IP. So why is this? Am I doing something obviously wrong? Could the mail server be interfering with the result?

Hope someone can help. Thanks in advance!

Jonathan Crooke
  • 912
  • 7
  • 19
  • If you remove `Require ..` directive, is site accessible? – Dusan Bajic Aug 09 '18 at 11:57
  • Yes indeed. It's only the require that's the problem. I also turned on debug logging, but the output doesn't show exactly how the forward dns verifies, unfortunately – Jonathan Crooke Aug 09 '18 at 11:58
  • 1
    make sure that hostname used in `Require forward-dns`, when tested from apache machine (for example try piniging the name and see what address is it trying to reach) resolves to a.b.c.d – Dusan Bajic Aug 09 '18 at 14:50
  • Aha! Great suggestion! ping on the machine returns the local IP, so that's surely the source of the problem. Probably just need to edit the hosts file. many thanks! – Jonathan Crooke Aug 09 '18 at 16:00
  • I solved this problem by adding the following section to my .conf file: ` Require forward-dns mydomain.com ` – Wavesailor Feb 03 '22 at 21:24

0 Answers0