http redirect

[tito]

hello I am trying to restrict access to allow only a range of IP. Why would wild cards not working?
<?
$ipaddy = getenv ("REMOTE_ADDR");
if ($ipaddy != "192.168.2.*") {
header("location:http://www.theaddress.com/redirect.php");
}
?>

[AstroTeg]

That wild card works in DOS and MS Access (and maybe a few other databases).

You would need to do some string tricks to make that work. One approach might be to explode the IP address on the period and take the first 3 array elements (or octets in this case) and compare each one. If the first array element = 192 and the 2nd equals 168 and the third equals 2 then let that user have access.

Another approach is to use [man]ip2long[/man] to convert the IP into a long integer. There's some nifty tricks you can do with bit masking. For what you're looking to do, you don't need to get this complex, but if you're comfy with IP addresses and how masking and subnets work, then you may want to check this out.

[tito]

Thanks. I will take the painful approach which means put in 100 IP in there.
what is the proper syntax please to replace my 'or' statement?
<?
$ipaddy = getenv ("REMOTE_ADDR");
if ($ipaddy != "192.168.2.100")

or
if ($ipaddy != "192.168.2.101")
or
if ($ipaddy != "192.168.2.102")

{
header("location:http://www.theaddress.com/redirect.php");
}
?>

[AstroTeg]

Huh? Why put all 100 in?

In the 192.168.2 subnet, is there only 100 you want to allow (out of the 254 total)?

[tito]

I need to give permissions to only 105 PC. I am not using DHCP. They all have static IP assigned. If it makes life easier for all 254, then it is fine.

[coditoergosum]

Umm, why not do a reg exp match?

if (preg_match("#192.168.2#", $ip)) { 
header("location: http://domain.tld/whatever.php"); 
} 

Of course that example would result in IPs like 12.192.168.2 getting redirected as well... but I don't have the time to write a pattern for the reg exp to do it correctly. The point is, just use a reg exp.

edit: Stupid automaic url parsing.

[AstroTeg]

Well, here's something to think about:

192.168.. as you know is a local only IP address. So the question is do you want to give everyone locally on your network access or just only to those 105 IPs?

If everyone is ok, then the trick I gave above about exploding on the period and checking the first 3 octets will work fine.

If you have to lock it down to the 105, you have a few options.

You could take the 4 octet and cast it as an integer and then test the range if its between 1 and 105. I'm thinking that would be pretty easy. You might still be able to do something with masking, but I got busy here and I'm not able to spend more time thinking about it...

[AstroTeg]

Now that I think about it - [man]ip2long[/man] would do the trick. The hardest part would be managing the overflow.

But looking past the overflow - taking the test IP and convert it to a long. Then take the value of 192.168.2.1 and convert that to a long. Add 105 to the long of 192.168.2.1. This becomes the top of your range. Then just use an if statement to test if the test IP is within this range. I'd key this up, but again, I'm a bit busy here...

[AstroTeg]

Ok - I new this was an easy problem. Here's the code:

$ip = '192.168.2.106';
$baseip = ip2long('192.168.2.1');

if(ip2long($ip) >= $baseip && ip2long($ip) <= $baseip + 104)
	echo 'In Range';
echo ' - Done';

If the IP is in range (192.168.2.1 - 192.168.2.105) then it'll print "in range" otherwise it'll just print "done". You'll need to modify this to fit your needs, but this code can be copied as is in its own PHP file and you can play with it.

You'll see "104" - this is the number of IPs in the range to test. You'll also find the $baseip value being the lowest IP you want to accept.

[tito]

thank you

[tito]

out of range, it redirects.
within the range, it is echoing 'range' but it also giving out this error message
Warning: Cannot modify header information - headers already sent by (output started at /mnt/hda3/www/site/start/office/index.php:4) in /mnt/hda3/www/site/start/office/index.php on line 7
line 7 is the redirect that I put to replace 'done'

[tito]

I got it to work. That is cool code. I never heard of it before.