How to block/allow IP addresses behind a load balancer with htaccess

When it comes to restrict your website, there are many ways to achieve that and one of the simplest methods is with your htaccess file. But it can be a little bit tricky when you’re in a cloud environment such as the Amazon Cloud and you are using the Elastic Load Balancer.

Normally you would put something like below to allow for two IP address

Order allow,deny Deny from all Allow from 11.11.11.11 Allow from 22.22.22.22

That works great as long as you don’t sit behind a load balancer, then the system will always think you are coming from the load balancers IP which we don’t want to block. Apache stores the client IP in an environment variable called X-FORWARDED-FOR, here’s an example to allow for the same IP addresses as above.

SetEnvIF X-FORWARDED-FOR "11.11.11.11" AllowIP SetEnvIF X-FORWARDED-FOR "22.22.22.22" AllowIP Order deny,allow Deny from all Allow from env=AllowIP

If you want to do the opposite and block just use “Deny from env=AllowIP”

There is also a second option with mod_rpaf which can alter the header and put the X-FORWARDED-FOR value in the Client IP.

Also be careful when using PHP and checking against remote IP, $_SERVER['REMOTE_ADDR'], in this case that will contain the load balancers IP. To get the real value try and use
$_SERVER['HTTP_X_FORWARDED_FOR'] instead.

Securing WordPress Dashboard using .htaccess behind CloudFlare (or any other CDN)

You may wish to increase the security of your WordPress blog by doing this, or you may not. It’s a matter of preference. Before today I never bothered, but since I wanted to figure out how it can be done, now it makes no sense to remove the extra security.

In all cases, there are 2 areas that can be locked down from 2 separate .htaccess files. These are:

• /wordpress/.htaccess to secure the wp-login.php file (used to log in).
• /wordpress/wp-admin/.htaccess to secure everything under the wp-admin directory.

I want to allow only a few IP addresses to be able to access these areas. This is how it’s done without a cloud:

1 2 3 4 5 6 7

# add the following lines to /wordpress/.htaccess <Files wp-login.php>     order deny,allow     deny from all     allow from 93.75.252.219     allow from 110.170.50.32 </Files>

1 2 3 4 5

# add the following lines to /wordpress/wp-admin/.htaccess order deny,allow deny from all allow from 93.75.252.219 allow from 110.170.50.32

Access to the login and admin areas of your website are now restricted to only the IPs you allow. If however, you are using a service like CloudFlare, the above will not work because apache can’t see your (the visitor’s) IP address. Let’s fix this:

1 2 3 4 5 6 7 8

# add the following lines to /wordpress/.htaccess <Files wp-login.php>     SetEnvIf X-FORWARDED-FOR 93.75.252.219 allowedip     SetEnvIf X-FORWARDED-FOR 110.170.50.32 allowedip     order deny,allow     deny from all     allow from env=allowedip </Files>

1 2 3 4 5 6

# add the following lines to /wordpress/wp-admin/.htaccess SetEnvIf X-FORWARDED-FOR 93.75.252.219 allowedip SetEnvIf X-FORWARDED-FOR 110.170.50.32 allowedip order deny,allow deny from all allow from env=allowedip

Apache is now reading your IP address and setting the allowedip environment variable which is then whitelisted on the last line.

Note that you should *not* rely on this security measure alone since an IP address you have whitelisted can and may be spoofed. Always monitor your access logs and combine this with other security methods (such as basic authentication for example) to further increase security.

Source: http://blog.ergatides.com/2011/09/07/securing-wordpress-dashboard-using-htaccess-behind-cloudflare-or-any-other-cdn/#ixzz2GKPcUHyG