[mod-security-users] Block access to web-app based on source IP

[Clayton Dillard]

We have JBoss web application that is front-ended with Apache and we
want to only allow access to /path-to-app/start-page for our internal IP
ranges. We've tried using the Apache <Directory> and <LocationMatch>
and <Location> directives with allow and deny but I think since this is
actually a Jboss app, it's not working as intended.

Can ModSecurity be setup to allow access to /path-to-app/start-page
based on source IP? If so, can someone offer some pointers on how we
would do that, or references to the docs that talk about how?

Thanks!
CTD

[Ryan Barnett]

Post by Clayton Dillard
We have JBoss web application that is front-ended with Apache and we
want to only allow access to /path-to-app/start-page for our internal IP
ranges. We've tried using the Apache <Directory> and <LocationMatch>
and <Location> directives with allow and deny but I think since this is
actually a Jboss app, it's not working as intended.
Can ModSecurity be setup to allow access to /path-to-app/start-page
based on source IP? If so, can someone offer some pointers on how we
would do that, or references to the docs that talk about how?
Thanks!
CTD

Try this -

SecRule REQUEST_URI "@streq /path-to-app/start-page"
"chain,phase:1,t:none,log,block,msg:'External IP Address Access Attempt.'"
SecRule REMOTE_ADDR "!^10\.10\.10\.1$"


You will need to update the IP address ranges appropriately.

-Ryan

[Clayton Dillard]

Thanks Ryan,
I'll try that out tonight and let you know.

Best,
Clay

Post by Ryan Barnett
"chain,phase:1,t:none,log,block,msg:'External IP Address Access Attempt.'"
SecRule REMOTE_ADDR "!^10\.10\.10\.1$"

[Clayton Dillard]

Works like a champ! Thanks Ryan, and thanks to the whole ModSec team.

Post by Ryan Barnett
"chain,phase:1,t:none,log,block,msg:'External IP Address Access Attempt.'"
SecRule REMOTE_ADDR "!^10\.10\.10\.1$"