Ip限制与.htaccess [关闭]

i want to make a firewall with anti flood for werbsite, is possible to restrict accces to an ip?

Not like 403 Forbidden

The 1000th time: NO, you can't protect your website by IP restrictions.

Attackers could use use proxies or spoof their IP's.


If you really encounter some sort of heavy traffic from one single IP, you could temporarily block this IP using a system-wide firewall rule (check iptables). Temporary because this IP will likely change frequently. Doing so would prevent hackers from exhausting the TCP connection table, but the traffic would still stress your network card, and the router you're behind + your bandwith.

If you encounter such situations, report this immediately to your web hoster.

Not that I would ban using IP address and .htccess, but to directly answer your question you can add this to your .htaccess files to ban by IP if that is what you really wish to do:

<Limit GET POST>
  order allow,deny
  allow from all
  deny from 1.2.3.4
  deny from 5.6.7.8
</Limit>

I'm not sure if the title of your question is out of sync with the question itself. It is ambiguous given the nature of the comment about the "403 Forbidden" yet the title is "IP Restriction with .htaccess". It is possible my answer is not what you were looking for.

If you are using Linux/BSD etc with netfilter or iptables then the program fail2ban may be of help. It automatically scans logs and uses firewall rules to block IPs. See Fail2ban IP Firewall blaclist tool. It supports Apache, SSH among a number of programs that produce logs.

The way this all works is that fail2ban has a daemon that monitors log files for varying servers it knows about (including Apache). It has heuristics to detect intrusions. If it finds an intrusion it issues OS commands for netfilters or iptables that add firewall rules to block the IP. So this type of block will prevent packets from reaching an application. The command line tool also allows you to ban an IP address manually. Like the daemon it will add the appropriate firewall of the OS. The command line tool can be scripted.