当前位置：文江博客话题详情

如何配置 mod_proxy 以阻止除一个网站之外的所有网站

发布于 2024-11-09 10:35:53 字数 141 浏览 0 评论 0原文

我正在尝试设置 mod 代理来阻止除特定域之外的所有流量。我可以将其配置为使用 ProxyBlock 指令阻止各个域，并且可以使用 ProxyBlock * 阻止所有内容。有没有一种方法可以阻止除一个域之外的所有域？

谢谢，

-安德鲁

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

み格子的夏天 2024-11-16 10:35:53

在 apache 2.2 上，您需要有 2 个 proxy 部分。

ProxyRequests On
ProxyVia On

# block all domains except our target
<ProxyMatch ^((?!www\.proxytarget\.com).)*gt;
   Order deny,allow
   Deny from all
</ProxyMatch>

# here goes your usual proxy configuration...
<ProxyMatch www\.proxytarget\.com >
   Order deny,allow
   Deny from all
   Allow from 127.0.0.1
</ProxyMatch>

在 apache 2.4 上，这会更容易，因为您可以使用 If 指令< /a> 而不是该正则表达式来反转域名的匹配。

注意：我从 Invert match with regexp 得到了该正则表达式

On apache 2.2 you need to have 2 proxy sections.

ProxyRequests On
ProxyVia On

# block all domains except our target
<ProxyMatch ^((?!www\.proxytarget\.com).)*gt;
   Order deny,allow
   Deny from all
</ProxyMatch>

# here goes your usual proxy configuration...
<ProxyMatch www\.proxytarget\.com >
   Order deny,allow
   Deny from all
   Allow from 127.0.0.1
</ProxyMatch>

On apache 2.4 it would be much easier because you could use the If directive instead of that regexp to invert the match for the domain name.

Note: I got that regexp from Invert match with regexp

回复收藏 0 原文

他不在意 2024-11-16 10:35:53

尝试：

ProxyBlock *
ProxyPass <path> <destination>

看看是否有效。

编辑：从头开始。我认为你必须在这里使用 mod_rewrite 发挥创意（基本参考位于 http:// /httpd.apache.org/docs/current/rewrite/proxy.html）：

RewriteCond  %{HTTP_HOST}    =allowtoproxy.com
RewriteRule  ^/(.*)$         http://proxytarget.com/$1 [P]
ProxyPassReverse / http://proxytarget.com/

尝试一下吗？

Try:

ProxyBlock *
ProxyPass <path> <destination>

See if that works.

EDIT: scratch that. I think you have to get creative here with mod_rewrite (the basic reference is at http://httpd.apache.org/docs/current/rewrite/proxy.html):

RewriteCond  %{HTTP_HOST}    =allowtoproxy.com
RewriteRule  ^/(.*)$         http://proxytarget.com/$1 [P]
ProxyPassReverse / http://proxytarget.com/

Try that?

回复收藏 0 原文

意中人 2024-11-16 10:35:53

Apache 2.4：这对我有用：首先拒绝一切，然后有选择地授予。

ProxyRequests On
ProxyVia Off
AllowCONNECT 443 563 80

<Proxy *>
    Require all denied
</Proxy>

<ProxyMatch "^https?://[a-z]*\.?google\.com.*$">
    Require all granted
</ProxyMatch>

<ProxyMatch "^[a-z]*\.?google\.com:443$">
    Require all granted
</ProxyMatch>

请注意，HTTPS 需要第二个 ProxyMatch（带有 :443），否则您的请求将得到：

Received HTTP code 403 from proxy after CONNECT

意味着您的 https 已通过，但 SSL 隧道被拒绝。

这适用于 Apache 侦听 :80，使用以下请求

curl -x localhost:80“https://www.google.com?q=mod_proxy&language=de”

但不包含

curl -x localhost:80“https://www.bing.com?q=google.com”

这是必不可少的，因为否则您可以通过伪造的查询字符串参数绕过白名单。

Apache 2.4: this worked for me: deny everything first then grant selectively.

ProxyRequests On
ProxyVia Off
AllowCONNECT 443 563 80

<Proxy *>
    Require all denied
</Proxy>

<ProxyMatch "^https?://[a-z]*\.?google\.com.*quot;>
    Require all granted
</ProxyMatch>

<ProxyMatch "^[a-z]*\.?google\.com:443quot;>
    Require all granted
</ProxyMatch>

Note the second ProxyMatch (with the :443) is required for HTTPS because else your request gets:

Received HTTP code 403 from proxy after CONNECT

meaning your https went through, but the SSL tunnel is rejected.

This works with Apache listening on :80, using the following request

curl -x localhost:80 "https://www.google.com?q=mod_proxy&language=de"

but not with

curl -x localhost:80 "https://www.bing.com?q=google.com"

which is essential, because otherwise you can circumvent the whitelisting by means of a bogus querystring parameter.

回复收藏 0 原文

单调的奢华 2024-11-16 10:35:53

试试这个代码：

RewriteEngine On
# Testing URLs
RewriteCond %{HTTP_HOST} !google.co.uk [NC]
RewriteCond %{HTTP_HOST} !bbc.co.uk [NC]
RewriteCond %{HTTP_HOST} !amazon.com [NC]
RewriteCond %{HTTP_HOST} !centos.org [NC]
RewriteCond %{HTTP_HOST} !opensuse.org [NC]
# Url to redirect to if not in allowed list
RewriteRule (.*) http://example.org/notallowed.htm

Try this code:

RewriteEngine On
# Testing URLs
RewriteCond %{HTTP_HOST} !google.co.uk [NC]
RewriteCond %{HTTP_HOST} !bbc.co.uk [NC]
RewriteCond %{HTTP_HOST} !amazon.com [NC]
RewriteCond %{HTTP_HOST} !centos.org [NC]
RewriteCond %{HTTP_HOST} !opensuse.org [NC]
# Url to redirect to if not in allowed list
RewriteRule (.*) http://example.org/notallowed.htm

回复收藏 0 原文

~没有更多了~