If someone knows your Hosting IP address, they can bypass our Firewall and try to access your site directly. It is not common or easy to do so, but for additional security, we recommend only allowing HTTP access from our Firewall IP addresses.
The best way to prevent hackers from bypassing our Firewall is limiting their access to your web server with bypass prevention rules.
Before adding firewall bypass prevention rules, make sure your DNS changes have fully propagated. If not, you may block valid visitors whose DNS has stale information. Four hours is usually enough, but you can check DNS propagation with this tool.
2) Click here to go to the Preventing Firewall Bypass settings.
3) Select the proper server for your hosting configuration. You will need to add the code for Apache in your .htaccess file. For Nginx, you will need to add the code to your Nginx configuration file.
- IIS
It will depend on what version of IIS you are using for the exact instructions, but the following links provide various options for different IIS versions: IIS 7 and IIS 8.
You can also try to use web.config file to prevent bypass.
- Lighttpd
Append the following configuration directive on “lighttpd.conf” file:
$HTTP[url] =~ ^/$ {
$HTTP[remoteip] == 192.88.134.0/23 {
}
else $HTTP[remoteip] == 185.93.228.0/22 {
}
else $HTTP[remoteip] == 66.248.200.0/22 {
}
else $HTTP[remoteip] == 208.109.0.0/22 {
}
else $HTTP[remoteip] != {
url.access-deny = ( )
}
}Known Issues
500 Internal Server Error
If your site starts responding with a 500 error after adding the bypass prevention rules, your server probably doesn’t support IPv6. Please remove the line referring to IPv6 (2a02:fe80::/29) from the bypass prevention rules, save the changes and then check the site to see if the error has been resolved. This error may persist for a short time after you remove the setting. Make sure to test the site in an incognito window so you do not see cached results.
403 Forbidden
There are a few possible reasons for this error:
1) The DNS propagation didn’t finish. Four to six hours is usually enough, but you can check propagation here.
2) If you followed the “Bypassing Firewall for Testing” article, you may have forgotten to remove the server IP from your “hosts” file. Remove that line from the “hosts” file to ensure your connection is going through the firewall IP address.
3) If you are a WPEngine, Rackspace or Siteground customer or your hosting provider uses a reverse proxy such as NGINX or Varnish in front of the real web server, you won’t be able to use the above methods to restrict access. Depending on the reverse proxy setup, the reverse proxy will translate the visitor IP address directly to the web server or use “localhost” for all requests. Therefore, the web server can’t see the Firewall IP and won’t be able to block the bypassed request. In this case, you must reach out to your hosting provider so they can block the bypass on a software firewall level (such as iptables).
We recommend consulting with your developer for assistance with implementing bypass prevention, but if you have any questions, please open a ticket here.