Restrict direct IP access

Hi ultrapep, I dont believe you can restrict on FQDN but you can add an IP Access rule either in the Global or Domain Details sections. Note that this will restrict all protocol, not just the web panel to that IP.

Alternativly, just add a firewall rule on the server OS/firewall to only allow 443 from a specific IP or range.

Are you trying to stop users from accessing the site via https://127.0.0.1 for example, and only permit https://mysite.local?

Honestly I'm not too familiar with SERV-U FTP but normally I would think of using IIS URL Rewrite for this. But I'm not sure what this product uses for its web server. That would determine your options and method.

We allow only 443 port.

But I still can login by untrusted cert and to direct IP.

We allow only 443 port.

But I still can login by untrusted cert and to direct IP.

If I could make a good opsec recommendation... edit your last post and either remove the photo or blur/black out your address bar and logos etc.

Serv-U Managent > Domain Details > IP Access > Add a rule for your IP, all other IPswill be rejected

Hi calc2014 I think ultrapep is looking to deny accessing the server directly via its serverside IP address, not a specific client source.

Exactly!

Please can you explain why you dont want the server to be accessible at all via its IP with an invalid cert warning? This would be the same with a web server if you accessed it by it's IP rather than it's hostname as the address does not match the certificate (you would get the same going to Google via https://142.250.178.14).

If you really need to stop people accessing the web interface via it's IP, you could try using the Virtual Hosts feature by creating a blank domain to catch all the IP traffic and then a virtual host for the specific FQDN. I havent used this but it is documented here:

https://support.solarwinds.com/SuccessCenter/s/article/Virtual-Hosts-In-Serv-U?language=en_US

ttps://support.solarwinds.com/SuccessCenter/s/article/Virtual-Hosts-In-Serv-U?language=en_US

You should also note that FTP(S) does not support host-headers by default and would rely on the client software sending the 'SITE' command with the domain name to ensure it goes to your Virtual Host.

As far as I am aware, SFTP does not support host headers at allQuote