0

I have a folder that I don't want to be accessible from outside my network's LAN. It seems like all traffic from the outside world goes through my firewall (192.168.1.39). So I made my .htaccess as follows:

Order Allow,Deny
Allow from all
Deny from 192.168.1.39

My thinking is that it allows all traffic, except for traffic that is redirected by my firewall: ie all external traffic.

Is there anything I'm missing? Any way for a hacker to bypass the firewall to get at the server directly? Any way to use IP spoofing to get around the .htaccess? etc?

EDIT: I can't allow from the local LAN with either a subnet or domain, because the external traffic looks like it is coming from the local LAN. It is being redirected from my firewall, a forigate inside the network.

  • you could set a .htpasswd in your folder to restrict access only to users who can login – CIRCLE Jul 14 '14 at 21:15
  • How do you know that all traffic goes through your firewall? Are you running a NAT? – Ari Trachtenberg Jul 14 '14 at 23:34
  • The app I'm protecting already has a login system. I think An ip list, htpasswd, and app passwd would be a bit much. @Ari: I accessed it on my phone and home PC with different browsers and looked at what IP it was receiving. In other words, I know that web traffic from a browser goes through that channel. – Shane Jul 15 '14 at 13:48
2

You should specifically allow the IP address(es) that is allowed to access the resource and Deny everything else.

order deny,allow
deny from all
allow from [your ip address] OR Allow from 10.0.0.0/24

Depending on your network configuration, requests to the server from the internet may include public IP addresses. Routers typically only provide NAT from the LAN network to the WAN network, not the other way around.

0

You can give Allow from a domain if you want to give access to local network. Then you can control machines in the domain.

<Directory /> 
    Order deny,allow
    Deny from all
    Allow from local.example.com
</Directory>

Anyway allow all and deny from 192.168.1.39 is a bad idea since black listing is not very secure.

0

My first order of business would be to block traffic arriving from the external/untrusted interface at the firewall with a destination address/port matching your web server. This is the whole point of having a firewall.

When it comes to your web server I would avoid using a .htaccess file unless you do not control the server and have to rely on user level controls. Your post makes me think you have complete control of your server and can edit the http.conf and make the changes there. While you can use the Deny/Allow directives to limit access you might want to consider restriciting the listening socket and virtual host to an internal IP address before taking the black/whitelist approach.

If you do control your server I would also recommend that you disable the use of .htaccess completely by setting "AllowOverride None" in the Apache configuration. There are two reasons for this, first htaccess causes a performance hit on your server, second it leaves a huge attack surface for hackers. I have created a project that illustrates why .htaccess files should be disabled from a security prespective: https://github.com/wireghoul/htshells/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.