How to restrict admin url from accessing some ip address - .htaccess

I am working on Magento2. As per the requirement, I want to restrict admin URL to some of the IPs and rest should be accessible. Tried multiple solutions from the StackOverflow for Htaccess Method but none of the solution work for me.
Using Apache 2.4 and Magento version 2.3
RewriteCond %{REQUEST_URI} ^/(index.php/)?admin [NC]
RewriteCond %{REMOTE_ADDR} !^11.222.33.444 [OR]
RewriteCond %{REMOTE_ADDR} !^11.222.55.444 [OR]
RewriteCond %{REMOTE_ADDR} !^11.333.22.33
RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=302,L]
Admin URL should be accessible to certain Ip's.

Try below code in your .htaccess file
<Directory>
order deny,allow
deny from 125.xx.10x.11x
</Directory>
Note: where 125.xx.10x.11x the IP address which you want to restrict.
Reference Urls:
1. https://www.mageplaza.com/kb/restrict-access-magento-2-admin.html
2. https://bobcares.com/blog/magento-block-ip-address/
I hope it will help...!!!

Related

How to redirect all users to maintainence page except certain IPS through .htaccess

I am new to .htaccess and not able to write conditions in .htaccess as per my need. I have tried many similar solutions shared by other users but still problem is not resolved. So that's why I am putting my issue separately here.
I have a website but for few days, it is going in maintainence mode. For this, I have created maintainence.php file in the root directory. So, if any user hit any url under this domain then they will get message written in maintainence.php file.
But I want to allow some IPs to access whole website, any url under the domain. I am trying to do this thing using .htaccess. And I think doing this with .htaccess file is the best way.
What I have tried is given below:
<IfModule mod_rewrite.c>
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} ^xxx\.xx\.xx\.xx$ #this is IP that I want to allow
RewriteCond %{REQUEST_URI} !=/maintainence.php
RewriteRule ^(/.*)?$ /maintainence.php [R=301,L]
</IfModule>
The above solution is redirecting everyone to maintainence.php including the mentioned IP.
Can anyone please help me on this? Thanks in Advance
You are almost deny that IP not allow it , so if you want to allow some IPs and prevent others just fix your code like this :
<IfModule mod_rewrite.c>
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^xxx\.xx\.xx\.xx [OR]
RewriteCond %{REMOTE_ADDR} !^xxx\.xx\.xx\.xx [OR]
RewriteCond %{REMOTE_ADDR} !^xxx\.xx\.xx\.xx
# i just excluded three but you could do less or more
RewriteCond %{REQUEST_URI} !=/maintainence.php
RewriteRule ^(.*)$ /maintainence.php [R=301,L]
</IfModule>
Note: clear browser cache the test it.

Rewrite rule to show maintenance page for IPs not in the list

I need to allow site access to only development team accessing from IPs 111.111.111.111 and 222.222.222.222 and for the rest of the visitors would like to show temporary maintenance page brb.html
I tried this with the following condition and rewrite rule and it got into a redirect loop. Any insights on how to make this work?
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^222\.222\.222\.222
RewriteCond %{REMOTE_ADDR} !^111\.111\.111\.111
RewriteCond %{SCRIPT_FILENAME} !^brb.html
RewriteRule ^.*$ /brb.html [R=307,L]
Note: IPs used above are not the real ones.
You can use:
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^(222\.222\.222\.222|111\.111\.111\.111)
RewriteRule !^brb\.html$ /brb.html [R=307,L]
And test in a new browser.
!^brb\.html$ in rewrite rule pattern will stop looping for you.
SOLUTION:
Because of CloudFlare I had to use RewriteCond %{HTTP:X-FORWARDED-FOR} instead of RewriteCond %{REMOTE_ADDR}

How to Re-direct users by IP address except to a specific directory

I am testing a website before i make it live and i am using .htaccess to re-direct users by IP address to the Facebook Group Page while i finish the testing. We are 3 developers and i have been able to allow specific IP addresses to access the site.
However, i want to make a certain directory accessible by everyone. Please let me know how i can do that. This is my .htaccess code:
RewriteEngine On
RewriteBase /
RewriteCond %{REMOTE_HOST} !^41\.210\.129\.
RewriteCond %{REMOTE_HOST} !^196\.0\.41\.54
RewriteCond %{REMOTE_HOST} !^41\.202\.225\.154
RewriteRule .* http://www.facebook.com/groups/tradelinksafrica/ [R=302,L]
Thank you!
You could use this RewriteCond: RewriteCond %{REQUEST_URI} !^/folder [NC]

.htaccess redirect to all IP's but mine

Basically, I am trying to work on the front end of a website, but I would like everyone else but myself to be redirected to a construction page if you like. I currently have:
redirect 301 /index.php http://www.domain.com/construction.php
While this works, it works to well, I would like to be able to still see the live site myself, is it possible to exclude everyone but my IP?
Thanks again.
You could do it with mod_rewrite
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=123.45.67.89
RewriteRule index.php$ /construction.php [R=301,L]
You'll need some conditions before redirecting:
RewriteCond %{REMOTE_ADDR} !=1.3.3.7
RewriteCond %{REQUEST_URI} !=/construction.php
RewriteRule .* /construction.php [L]
Also, to make sure after the lock-out is removed, clients will see the actual page, this solution does not redirect clients permanently (using a 301 redirect), but internally redirects. Substitute 1.3.3.7 for the actual IP address you're using.
If your apache version is 2.4* , You can redirect your visiters to construction page using the following directives in htaccess :
<If "%{REMOTE_ADDR} !='yourIp'">
RedirectMatch ^/((?!construction.php).*)$ /construction.php
</If>
It says if the ip address is not yourIp redirect all requests to /construction.php .
On older versions of apache, you can use the following mod-rewrite based solution :
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^myIP$
RewriteRule !construction\.php /construction.php [L]
This internally forwords the request to /construction.php if the RewriteCondition meets. You can Replace L with R if you want to see the redirected url in browser address bar.
hi there you could do the following in .htaccess file
RewriteEngine on
# Redirect all except allowed IP
RewriteCond %{REMOTE_ADDR} !^12.345\.678\.901$
RewriteRule /index.php http://www.domain.com/construction.php [R=302,L]
putting your IP instead of 12.345.678.901
If you have a range of IPs you want to exclude from seeing 'under construction' page you can use |
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^127.0.0.1|212.250.141.228
RewriteRule ! construction\.html /construction.html [R]
It is important to put the 2 last lines at the end of your .htaccess file, especially when it contains more rewriting rules.
The following worked for me
Deny from all
Allow from xxx.xxx.xx.xxx
If you are interested on having a background image referenced on your construction.php, the code below avoids the image to be redirected:
RewriteCond %{REMOTE_ADDR} !=THE_IP
RewriteCond %{REQUEST_URI} !^\/construction\.php|\/YOUR_IMAGE\.jpg
RewriteRule .* /construction.php [R=302,L]
In addition to using the if directive as other answers suggested, you can also add multiple IPs by including other conditions into one directive using the && operator as such:
<If "%{REMOTE_ADDR} != '127.0.0.1' && %{REMOTE_ADDR} != '192.168.1.1'">
RedirectMatch ^/((?!construction.php).*)$ /construction.php
</If>
See the docs here: http://httpd.apache.org/docs/2.4/mod/core.html#if
Another idea is to give access only to a certain range
RewriteEngine on
RewriteBase /
# Validator
SetEnvIf Remote_Addr "^128.30." IsInt
# Local
SetEnvIf Remote_Addr "^192\.168" IsInt
Order allow,deny
Allow from env=IsInt
Not any one worked until I find my own solution
URL in code: http://www.example.com/index_cons.php
IP address in example is: 75.85.95.105
Tested on lastest version of Cpanel.
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^75\.85\.95\.105
RewriteCond %{HTTP_HOST} ^example\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com$
RewriteRule ^/?$ "http\:\/\/example\.com\/index_cons\.php" [R=302,L]

htaccess redirect - allow files for construction page

I've tried to set up a htaccess redirect for everyone except me. It works fine...except that I have to write an exception for every file that the under construction page wants. This will take me a while and I'm certain there is a proper way to do it, I just cant find it.
I have tried this:
order deny,allow
deny from all
allow from 205.97.194.334
ErrorDocument 403 http://www.domain.com/page.htm
<Files page.htm>
allow from all
</Files>
But I get an internal server error
What I have now is this:
RewriteEngine On
RewriteBase /
RewriteCond %{REMOTE_HOST} !^127\.0\.0\.1
RewriteCond %{REQUEST_URI} !/mypage\.html$
RewriteRule .* http://www.domain.com/construct/mypage.html [R=302,L]
What can I add in this to allow everything in the /construct/ ?#
Thankyou
P.S. Can anyone tell me why the first attempt didn't work?
EDIT:
Ok I've added this, which allowed the files, however, it is only redirecting when the directory is entered. I.e. domain.com will redirect to the construction page, but domain.com/index.php and anything else will not redirect
# Redirect everyone who's not from your IP
RewriteCond %{REMOTE_ADDR} !00.00.00.00 [NC]
# Allow real files to be served
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule !index.html$ http://subverb.net/construct/index.html [R=307,L]
If you want /construct to be available to everyone else, and you want them to be redirected to that URL when opening any other URL:
# IF not from your address
RewriteCond %{REMOTE_ADDR} !^123\.4\.5\.6$
# AND not for /construct directory
RewriteCond %{REQUEST_URI} !^/construct
# THEN sen them to /construct/index.html
RewriteRule (.*) /construct/index.html [R=307,L]

Resources