httpd and two different networks.

[Erik J]

Hello Back Again

with a total fresh install of Alt-F.
D-Link firmware is no fun.

One simple question, I think.

I am trying to access the Status page from another subnet of an intranet.
I can easily ssh into the box, but, as I am copying hd's at the moment, I would like to access the web interface.

I edited httpd.conf
A:127.0.0.1     #!# Allow local loopback connections
D:*             #!# Deny from other IP connections
A:192.168.1.0/255.255.255.0 #!# Allow local net
A:10.xxxxxx/255.255.255.224 #!# Allow local net

also like this
A:127.0.0.1     #!# Allow local loopback connections
D:*             #!# Deny from other IP connections
A:192.168.1.0/255.255.255.0, 10.xxxxxx/255.255.255.224 #!# Allow local net


restarted it with httpd restart
with outcome: httpd: bind: Address already in use

did an udhcpc restart

[root@terra]# udhcpc restart
udhcpc (v1.20.2) started
udhcpc: Deconfiguring eth0
Sending discover...
Sending select for 192.168.1.100...
Lease of 192.168.1.100 obtained, lease time 9000
udhcpc: Renew: Using 192.168.1.100 for 9000 seconds
udhcpc: Updating /etc/hosts: 192.168.1.100 terra.localnet terra
udhcpc: Updating /etc/httpd.conf: allow 192.168.1.0/255.255.255.0
udhcpc: Updating /etc/samba/smb.conf: allow 192.168.1.0/255.255.255.0
udhcpc: Updating eth0 default route: adding route 192.168.1.13
udhcpc: Updating /etc/resolv.conf: adding nameserver 192.168.1.13

But no luck the 10.xxx series does not enter the "allowed stage", and I keep on getting the 403 forbidden page in my web browser.

How to manually configure httpd.cfg?

I have no owncloud or any other services running at the moment. Just a very fresh install this morning.

Thanks!

[João Cardoso]

On Thursday, March 19, 2015 at 3:25:48 PM UTC, Erik J wrote:

Hello Back Again

with a total fresh install of Alt-F.
D-Link firmware is no fun.

One simple question, I think.

I am trying to access the Status page from another subnet of an intranet.
I can easily ssh into the box, but, as I am copying hd's at the moment, I would like to access the web interface.

I edited httpd.conf
A:127.0.0.1     #!# Allow local loopback connections
D:*             #!# Deny from other IP connections
A:192.168.1.0/255.255.255.0 #!# Allow local net
A:10.xxxxxx/255.255.255.224 #!# Allow local net

also like this
A:127.0.0.1     #!# Allow local loopback connections
D:*             #!# Deny from other IP connections
A:192.168.1.0/255.255.255.0, 10.xxxxxx/255.255.255.224 #!# Allow local net


restarted it with httpd restart

There is no need to do that. httpd is not always running (inetd is) until a page is requested, and it read its config at that moment.

 

with outcome: httpd: bind: Address already in use

The previous httpd request was not completed and httpd was still running (the 'ps' command should show you that)

 

did an udhcpc restart

[root@terra]# udhcpc restart
udhcpc (v1.20.2) started
udhcpc: Deconfiguring eth0
Sending discover...
Sending select for 192.168.1.100...
Lease of 192.168.1.100 obtained, lease time 9000
udhcpc: Renew: Using 192.168.1.100 for 9000 seconds
udhcpc: Updating /etc/hosts: 192.168.1.100 terra.localnet terra
udhcpc: Updating /etc/httpd.conf: allow 192.168.1.0/255.255.255.0
udhcpc: Updating /etc/samba/smb.conf: allow 192.168.1.0/255.255.255.0
udhcpc: Updating eth0 default route: adding route 192.168.1.13
udhcpc: Updating /etc/resolv.conf: adding nameserver 192.168.1.13

But no luck the 10.xxx series does not enter the "allowed stage", and I keep on getting the 403 forbidden page in my web browser.

How to manually configure httpd.cfg?

This is the httpd source code "documentation":

 * A:172.20.         # Allow address from 172.20.0.0/16

 * A:10.0.0.0/25     # Allow any address from 10.0.0.0-10.0.0.127

 * A:10.0.0.0/255.255.255.128  # Allow any address that previous set

 * A:127.0.0.1       # Allow local loopback connections

 * D:*               # Deny from other IP connections

 ...

 * A/D may be as a/d or allow/deny - only first char matters.

 * Deny/Allow IP logic:

 *  - Default is to allow all (Allow all (A:*) is a no-op).

 *  - Deny rules take precedence over allow rules.

 *  - "Deny all" rule (D:*) is applied last.

 *

 * Example:

 *   1. Allow only specified addresses

 *     A:172.20          # Allow any address that begins with 172.20.

 *     A:10.10.          # Allow any address that begins with 10.10.

 *     A:127.0.0.1       # Allow local loopback connections

 *     D:*               # Deny from other IP connections

 *

 *   2. Only deny specified addresses

 *     D:1.2.3.        # deny from 1.2.3.0 - 1.2.3.255

 *     D:2.3.4.        # deny from 2.3.4.0 - 2.3.4.255

 *     A:*             # (optional line added for clarity)

 * 

can't help more... if you manage to do it, please report back.

[Erik J]

Got it!

It is all in the order.
So first the Allow, and last the Deny. Don't mix them up.
Up and logged in! Great.

Thanks again!