I need some help with securing my test XAMPP server as so far nothing I have tried seems to work. I am running Apache 2.4.7 on Windows 7 machine.
The setup is the following:
I am redirecting all traffic coming on my server IP, port 80 to a java application running on localhost:5000
.
The code doing all this in httpd-vhosts.conf
file is the following:
<VirtualHost *:80>
ProxyPreserveHost On
ProxyRequests Off
ServerName demo.website.com
ServerAlias website.com
ProxyPass / http://localhost:5000/
ProxyPassReverse / http://localhost:5000/
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
</VirtualHost>
The question is, how do I deny
traffic from specific external IP address?
It seems I cannot use .htaccess
because requests on port 80 are redirected to a java application, not a xampp folder containing web content.
Also, the code below does not do the job either:
<Proxy *>
order allow,deny
deny from 193.37.XXX.XX
allow from all
</Proxy>
What other options are there?
Any suggestions?
EDIT:
After the responses I got, it looks I have been doing the proxy reverse entirely wrong opening exploitable gaps in the server. Based on the answer provided, I have modified my initial code.
Since I am using similar insecure code for port 443 and I cannot get apache to start after the new modifications, I have posted a new question HERE.