# Haproxy acl to block ips and host header

**URL:** <https://discourse.haproxy.org/t/haproxy-acl-to-block-ips-and-host-header/4425>\
**Category:** Help!\
**Created:** [October 26, 2019, 1:56am UTC](https://discourse.haproxy.org/t/haproxy-acl-to-block-ips-and-host-header/4425 "2019-10-26T01:56:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aka](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@aka](https://discourse.haproxy.org/u/aka)\
**Post date:** [October 26, 2019, 1:56am UTC](https://discourse.haproxy.org/t/haproxy-acl-to-block-ips-and-host-header/4425/1 "2019-10-26T01:56:16Z")

</div>

Hi guys,  
I can’t get the following acls to work as intended.

acl src1 src xx.xx.xx.xx/xx  
acl src1 src yy.yy.yy.yy/yy  
acl admin hdr\_beg(host) -i admin  
acl adminservice hdr\_beg(host) -i adminservice

http-request deny if !src1 !adminservice admin

What I am trying to do is to block access to IPs other than src1 IPs to [admin.domainname.com](http://admin.domainname.com).  
But the result I am getting is, I have access to [admin.domainname.com](http://admin.domainname.com) after refreshing the page a few times. First it gives a 403 error but if I keep hitting refresh I am able to access the url.

Is the order of the condition in the action wrong? Could you please tell me what will be the result based on the above’s configuration?

Thanks,  
aka

---

<div class="post-metadata">

**Author:** ![jerome](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jerome/32/984_2.png) [@jerome](https://discourse.haproxy.org/u/jerome)\
**Post date:** [October 28, 2019, 12:28pm UTC](https://discourse.haproxy.org/t/haproxy-acl-to-block-ips-and-host-header/4425/2 "2019-10-28T12:28:42Z")

</div>

I’d use something like this:

```
  acl src1 src 1.2.3.4
  acl admin hdr(host) -m beg admin.
  http-request deny unless src1 admin 

```

your problem is that admin will match for both admin.domain and adminservice.domain.  
you can also use the dom match, ie:

```
  acl src1 src 1.2.3.4
  acl admin hdr(host) -m dom admin
  http-request deny unless src1 admin 

```

- “dom” : domain match : check that a dot-delimited portion of the contents  
exactly match one of the provided string patterns. This may be  
used with binary or string samples.  
[https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#7.1](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#7.1)

---

<div class="post-metadata">

**Author:** ![aka](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@aka](https://discourse.haproxy.org/u/aka)\
**Post date:** [December 17, 2020, 1:20am UTC](https://discourse.haproxy.org/t/haproxy-acl-to-block-ips-and-host-header/4425/3 "2020-12-17T01:20:09Z")

</div>

Thank you, that was useful.