Accessing a webpage only in the specified IP address

Question

I build a dashboard using PHP & MySql, where my company employees can log in, log out, request leaves, add work reports & maintain their attendance. everything was working fine, but my manager wants that dashboard to open only in our office network. Since it's a simple task, I added the below code to the login page.

<?php
$ip = $_SERVER['REMOTE_ADDR'];  

if($ip == "xxx.xxx.xxx.xxx")
{
}
else
{
  header("Location: error.php");
}
?>

On the error.php page, I added an error message "You are not allowed to access this page".

The IP address I am using is from Google (IPV4). This was working fine but recently I realized the internet IP address changes often. Now the condition is not working. So anyone can help me with which IP address I need to use in the conditions or what will be the solution for this.

You can ask your ISP for a fixed (static) IP address, and then you can use a non-PHP over arching system such as Apache [.htaccess to add some trivial rules](https://stackoverflow.com/questions/4400154/deny-all-allow-only-one-ip-through-htaccess) to only allow your static fixed IP address to access the files/folders. PS> Ulrich's answer is the best solution ( ie take it all inhouse into a local office internet) — Martin, May 27 '21 at 11:17

score 1 · Answer 1 · answered May 27 '21 at 11:10

There are two ways:

You redirect based on IP address ranges to an error page. That is basically a webserver configuration task. It requires you to know which IP addresses traffic from your office uses. For changing IP addresses, you need to keep the two in sync.
You move the whole server to your local office network. This is the preferred solution, because you have less infrastructure exposed to the (potentially hostile) internet.

Your approach is similar to the first one, only that you're trying to reimplement what your webserver already offers out of the box.

score 0 · Answer 2 · answered May 27 '21 at 08:04

0

You mean the IP of your company is not static and changes regularily ?

If so, you could create a script running on a computer in your company that would update the allowed IP on the server.

answered May 27 '21 at 08:04

SimonFA

31
6

How would it be trusted to be direction from a computer within the company rather than a computer from elsewhere? – Martin May 27 '21 at 11:18

score 0 · Answer 3 · answered May 29 '21 at 13:58

The issue has been resolved. If anyone looking for the answer,

The simplest solution I found on internet is allowing the entire subnet.

.htaccess code:

Order Deny,Allow
Deny from all
Allow from 111.111

Since the IPV4 is varying, I observed 1st 6 digits are static & only last 6 digits were varying.

So I removed PHP functions & using the above code in the htaccess I allowed the entire subnet (through 1st 6 digits)

Accessing a webpage only in the specified IP address

3 Answers3