How can i restrict /admin login page to a particular IP only?

Question

I want to restrict the http://www.mysite.com/admin login page to a particular IP only. Do you have any suggestion?

Answer 1

I think I would go for doing this at the Apache level before hitting Drupal.

Have a look at the Apache manual for doing this but you are looking at something like this:

# Only allow request for admin only from localhost.
<Location /admin>
  Deny from all
  Allow from 127.0.0.1
</Location>

So admin will be denied for all but allowed from 127.0.0.1 for example. Also take in to account cleanurls. You will need to deny access to ?q=admin aswell.

Answer 2

There are a lot of IP modules out there that block access to the website by IP, but these are black/whitelists for the whole website.

There is a module called Restrict IP which only allows whitelisted IPs to log in.

In general, this module provides features that allow an IP address (or range of IP addresses) to be whitelisted which restrict the functionality of users. Currently there are two features implemented:

Restrict login by IP

When a user is restricted, that user will not be able to log in outside the defined IP address ranges. It is also possible to specify global IP address ranges, which apply to ALL users, including user1. Following a denied log-in attempt, a user is redirected to an error page as specified by the site administrator.

Restrict role by IP

When a role is restricted, that role will not be available to users outside the defined IP address ranges. Role restriction does not affect users' ability to log in, only the availability of the restricted role to users. Role restrictions are available for all roles, except "anonymous user" and "authenticated user".

Answer 3

Have a look at the following function, it may help you:

function yourmodule_menu_alter($items) {
  $items['admin']['access callback'] = 'yourmodule_check_by_ip';
}

function yourmodule_check_by_ip() {
  switch ($_SERVER['REMOTE_ADDR']) {
    case 'PARTICULAR_IP_ADDRESS' :
      return false;
      break;
    case 'ANOTHER_PARTICULAR_IP_ADDRESS' :
      return false;
      break;
    …
    default:
      return TRUE;
  }
}

Answer 4

This can be done by configuring .htaccess to raise the [F] flag (returns a 403 Forbidden status code to the client) for certain URLs when %{REMOTE_ADDR} doesn't match a given IP.

To be placed after RewriteEngine on:

RewriteCond %{REMOTE_ADDR} !^100\.22\.44\.[8-9]$
RewriteRule ^/user - [F]
RewriteRule ^/USER - [F]

Answer 5

There is a module available for D7 to provide page level access for IPs

Restrict Page IP

Provides administrator to restrict/allow access to pages based on user IPs.

Features

• IPs can be an individual IP or range of Ips.
• Page url can have wild cards like 'blog/*'
• Restricted user IPs will be denied showing custom error message (can be modified on module's configuration page)

Note : User 1 has been skipped from these restrictions.