# Block Sub URL for all except list of few IPs

**URL:** <https://discourse.haproxy.org/t/block-sub-url-for-all-except-list-of-few-ips/920>\
**Category:** Help!\
**Created:** [January 6, 2017, 8:03pm UTC](https://discourse.haproxy.org/t/block-sub-url-for-all-except-list-of-few-ips/920 "2017-01-06T20:03:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arvindsaket](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@arvindsaket](https://discourse.haproxy.org/u/arvindsaket)\
**Post date:** [January 6, 2017, 8:03pm UTC](https://discourse.haproxy.org/t/block-sub-url-for-all-except-list-of-few-ips/920/1 "2017-01-06T20:03:58Z")

</div>

I am new to HAProxy. I want to restrict all to access a sub URL but not for access from few IPs. My Implementation of HAProxy is below and it is blocking all for IPs. I want “[example.com/abc/qaz](http://example.com/abc/qaz)” accessible from 1.1.1.1 and 2.2.2.2 only.

```
# Listen to port 80. Throw a 301 redirect to port 443
 frontend Listen80
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }

 # List to port 443. Redirect to appropriate backend based on URL
 frontend Listen443
   bind *:443 ssl crt /etc/ssl/certs/examplesslpem %>

   acl web_url path_beg /abc /xyz
   acl web_url path_beg /efg /xy
   acl batch_url path_beg /h /ga
   acl network_allowed src 1.1.1.1 2.2.2. 
   acl resticted_pages path_beg /abc/qaz/
   http-request deny if resticted_pages !network_allowed
   use_backend BATCH if batch_url
   use_backend SVC if svc_url
   use_backend WEB if web_url

   # Listen to port 8080. Pass through to WEB backend
  frontend Listen8080
   bind *:8080
   use_backend WEB

backend WEB
   mode http
   balance roundrobin
   option httpclose
   cookie SERVERIDWEB insert indirect nocache secure
   option forwardfor
   http-request set-header X-Forwarded-Port %[dst_port]
   http-request add-header X-Forwarded-Proto https if { ssl_fc }
   reqrep ^([^\]*\ /)abc[/]?(.*) \1\2
   server app-1 example-app1.com:8080 check cookie app1web
   server app-2 example-app2.com:8080 check cookie app2web
   server app-3 example-app3.com:8080 check cookie app3web
   server app-4 example-app4.com:8080 check cookie app4web
   server app-5 example-app5.com:8080 check cookie app5web
```

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 7, 2017, 10:44am UTC](https://discourse.haproxy.org/t/block-sub-url-for-all-except-list-of-few-ips/920/2 "2017-01-07T10:44:55Z")

</div>

The only thing you probably wanna fix is the last octet of the second IP is missing (2.2.2. should be 2.2.2.2), I don’t see anything else wrong in your configuration.

---

<div class="post-metadata">

**Author:** ![arvindsaket](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@arvindsaket](https://discourse.haproxy.org/u/arvindsaket)\
**Post date:** [January 14, 2017, 6:33pm UTC](https://discourse.haproxy.org/t/block-sub-url-for-all-except-list-of-few-ips/920/3 "2017-01-14T18:33:37Z")

</div>

Actually, due to cloudflare the HAProxy server was getting the CloudFlare IP. And it was block to all. I used CF-Connecting-IP and macthed it with the list of alowed IPs.  
acl restrict\_page path\_beg /abc/xyz  
acl Whitelist hdr\_ip(CF-Connecting-IP) -m ip -f /etc/haproxy/Whitelist.acl  
http-request deny if !Whitelist restrict\_page