You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Bruno Teixeira <br...@gmail.com> on 2007/02/16 13:17:17 UTC
[users@httpd] 403 Forbidden error with rewrite [P] flag
Hi there,
I've been browsing the web for a solution to my problem, but all I can
find are similar problems, no solutions...
I am using a rewrite rule to rewrite "http://192.168.2.251/secure"
requests to "https://192.168.2.198/". This works fine, but I don't the
user to see the "198 IP", but to always the "251". To accomplish this, I
thought I only had to add a "P flag" to the rewrite rule, but when I do
so, I get a "403 Forbidden error". I have the proxy module loaded!
I would really appreciate some input. Thank you for your time.
I get this on the error log:
[Fri Feb 16 11:13:14 2007] [error] [client 192.168.2.251] client denied
by server configuration: proxy:https://192.168.2.198
and this on the rewrite log:
192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
[192.168.2.251/sid#8162818][rid#82a2440/initial] (2) init rewrite engine
with requested uri /secure
192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
[192.168.2.251/sid#8162818][rid#82a2440/initial] (2) rewrite /secure ->
https://192.168.2.198
192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
[192.168.2.251/sid#8162818][rid#82a2440/initial] (2) forcing
proxy-throughput with https://192.168.2.198
192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
[192.168.2.251/sid#8162818][rid#82a2440/initial] (1) go-ahead with proxy
request proxy:https://192.168.2.198 [OK]
Here are both of the Virtual hosts:
<VirtualHost 192.168.2.251:80>
ServerAdmin webmaster@localhost
ServerName 192.168.2.251
DocumentRoot /var/www/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
# Uncomment this directive is you want to see apache2's
# default start page (in /apache2-default) when you go to /
RedirectMatch ^/$ /site
</Directory>
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>
ErrorLog /var/log/apache2/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog /var/log/apache2/access.log combined
ServerSignature On
RewriteEngine on
RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^/secure(.*)$ https://192.168.2.198$1 [L]
# RewriteRule ^/secure(.*)$ https://192.168.2.198$1 [L,P] this rule
gives the error
RewriteLog "/var/log/apache2/rewrite.log"
RewriteLogLevel 2
Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
Options Indexes MultiViews FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
</VirtualHost>
<VirtualHost 192.168.2.198:443>
ServerAdmin webmaster@localhost
ServerName 192.168.2.198
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/198.crt
SSLCertificateKeyFile /etc/apache2/ssl/198.key
DocumentRoot /var/www
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
RedirectMatch ^/$ /site
</Directory>
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>
ErrorLog /var/log/apache2/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog /var/log/apache2/access.log combined
ServerSignature On
Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
Options Indexes MultiViews FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
</VirtualHost>
Bruno Teixeira
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] 403 Forbidden error with rewrite [P] flag
Posted by Chirouze Olivier <ol...@volvo.com>.
Well, P flag should be enough, but make sure the site you are
redirecting to (the intranet web server) doesn't do a HTTP redirect. If
it does (and if it doesn't, that's safer anyway), you must use
ProxyPassReverse.
Also, make sure you don't use "R" flag! But I guess it's not permitted
to use it along with P anyway...
Olivier
Olivier CHIROUZE
I&0 Infrastructure
Volvo Information Technology
> -----Original Message-----
> From: Bruno Teixeira [mailto:brunoteixa@gmail.com]
> Sent: 21 February 2007 11:46
> To: users@httpd.apache.org
> Subject: Re: [users@httpd] 403 Forbidden error with rewrite [P] flag
>
> Hi krist,
>
> thank you very much for your sugestion. It wasn't the only
> problem with
> my configuration - I also had "deny from all" in the
> proxy.conf file -
> but with the SSLProxy On directive the rewrite now works.
>
> But I still have a problem: the original address isn't kept in the
> address bar... this is a problem because the proxy is the
> only external
> IP address. How can I keep the original address in the
> browser's address
> bar? Isn't this possible with the rewrite [P]? I have read that it is
> possible with an "old fashion" reverse proxy, doesn't the [P]
> do the same?
>
> Thank you for your time
>
> Bruno Teixeira
>
> Krist van Besien wrote:
> > On 2/16/07, Bruno Teixeira <br...@gmail.com> wrote:
> >
> >> I've been browsing the web for a solution to my problem,
> but all I can
> >> find are similar problems, no solutions...
> >>
> >> I am using a rewrite rule to rewrite "http://192.168.2.251/secure"
> >> requests to "https://192.168.2.198/". This works fine, but
> I don't the
> >> user to see the "198 IP", but to always the "251". To
> accomplish this, I
> >> thought I only had to add a "P flag" to the rewrite rule,
> but when I do
> >> so, I get a "403 Forbidden error". I have the proxy module loaded!
> >>
> >> I would really appreciate some input. Thank you for your time.
> >
> > You're welcome.
> >
> >>
> >> I get this on the error log:
> >>
> >> [Fri Feb 16 11:13:14 2007] [error] [client 192.168.2.251]
> client denied
> >> by server configuration: proxy:https://192.168.2.198
> >>
> >> and this on the rewrite log:
> >>
> >> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> >> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) init
> rewrite engine
> >> with requested uri /secure
> >> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> >> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2)
> rewrite /secure ->
> >> https://192.168.2.198
> >> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> >> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) forcing
> >> proxy-throughput with https://192.168.2.198
> >> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> >> [192.168.2.251/sid#8162818][rid#82a2440/initial] (1)
> go-ahead with proxy
> >> request proxy:https://192.168.2.198 [OK]
> >
> > What I see here is that a) your rewrite works, but b) your proxy
> > config has some problems.
> >
> > The problem is that proxying to an https server requires a bit more
> > than just adding a P to a rewrite statement. When proxing to https
> > your apache server has to take on the role of an SSL
> client, which the
> > standard out of the box apache hasn't been set up for.
> >
> > You need at least the following directives:
> >
> > SSLProxyEngine on
> > SSLProxyCACertificatePath /usr/local/apache2/conf/ssl.crt/
> >
> > And then in /usr/local/apache2/conf/ssl.crt/ (or whichever dir you
> > configure here) you need to add at least the root certificate of the
> > CA used to sign the SSL certificate you use on your https server.
> >
> > You can find out more about this by reading up on the SSLProxy
> > directives in the manual.
> >
> > Krist
> >
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] 403 Forbidden error with rewrite [P] flag
Posted by Bruno Teixeira <br...@gmail.com>.
Hi krist,
thank you very much for your sugestion. It wasn't the only problem with
my configuration - I also had "deny from all" in the proxy.conf file -
but with the SSLProxy On directive the rewrite now works.
But I still have a problem: the original address isn't kept in the
address bar... this is a problem because the proxy is the only external
IP address. How can I keep the original address in the browser's address
bar? Isn't this possible with the rewrite [P]? I have read that it is
possible with an "old fashion" reverse proxy, doesn't the [P] do the same?
Thank you for your time
Bruno Teixeira
Krist van Besien wrote:
> On 2/16/07, Bruno Teixeira <br...@gmail.com> wrote:
>
>> I've been browsing the web for a solution to my problem, but all I can
>> find are similar problems, no solutions...
>>
>> I am using a rewrite rule to rewrite "http://192.168.2.251/secure"
>> requests to "https://192.168.2.198/". This works fine, but I don't the
>> user to see the "198 IP", but to always the "251". To accomplish this, I
>> thought I only had to add a "P flag" to the rewrite rule, but when I do
>> so, I get a "403 Forbidden error". I have the proxy module loaded!
>>
>> I would really appreciate some input. Thank you for your time.
>
> You're welcome.
>
>>
>> I get this on the error log:
>>
>> [Fri Feb 16 11:13:14 2007] [error] [client 192.168.2.251] client denied
>> by server configuration: proxy:https://192.168.2.198
>>
>> and this on the rewrite log:
>>
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) init rewrite engine
>> with requested uri /secure
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) rewrite /secure ->
>> https://192.168.2.198
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) forcing
>> proxy-throughput with https://192.168.2.198
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (1) go-ahead with proxy
>> request proxy:https://192.168.2.198 [OK]
>
> What I see here is that a) your rewrite works, but b) your proxy
> config has some problems.
>
> The problem is that proxying to an https server requires a bit more
> than just adding a P to a rewrite statement. When proxing to https
> your apache server has to take on the role of an SSL client, which the
> standard out of the box apache hasn't been set up for.
>
> You need at least the following directives:
>
> SSLProxyEngine on
> SSLProxyCACertificatePath /usr/local/apache2/conf/ssl.crt/
>
> And then in /usr/local/apache2/conf/ssl.crt/ (or whichever dir you
> configure here) you need to add at least the root certificate of the
> CA used to sign the SSL certificate you use on your https server.
>
> You can find out more about this by reading up on the SSLProxy
> directives in the manual.
>
> Krist
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] 403 Forbidden error with rewrite [P] flag
Posted by Krist van Besien <kr...@gmail.com>.
On 2/16/07, Bruno Teixeira <br...@gmail.com> wrote:
> I've been browsing the web for a solution to my problem, but all I can
> find are similar problems, no solutions...
>
> I am using a rewrite rule to rewrite "http://192.168.2.251/secure"
> requests to "https://192.168.2.198/". This works fine, but I don't the
> user to see the "198 IP", but to always the "251". To accomplish this, I
> thought I only had to add a "P flag" to the rewrite rule, but when I do
> so, I get a "403 Forbidden error". I have the proxy module loaded!
>
> I would really appreciate some input. Thank you for your time.
You're welcome.
>
> I get this on the error log:
>
> [Fri Feb 16 11:13:14 2007] [error] [client 192.168.2.251] client denied
> by server configuration: proxy:https://192.168.2.198
>
> and this on the rewrite log:
>
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) init rewrite engine
> with requested uri /secure
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) rewrite /secure ->
> https://192.168.2.198
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) forcing
> proxy-throughput with https://192.168.2.198
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (1) go-ahead with proxy
> request proxy:https://192.168.2.198 [OK]
What I see here is that a) your rewrite works, but b) your proxy
config has some problems.
The problem is that proxying to an https server requires a bit more
than just adding a P to a rewrite statement. When proxing to https
your apache server has to take on the role of an SSL client, which the
standard out of the box apache hasn't been set up for.
You need at least the following directives:
SSLProxyEngine on
SSLProxyCACertificatePath /usr/local/apache2/conf/ssl.crt/
And then in /usr/local/apache2/conf/ssl.crt/ (or whichever dir you
configure here) you need to add at least the root certificate of the
CA used to sign the SSL certificate you use on your https server.
You can find out more about this by reading up on the SSLProxy
directives in the manual.
Krist
--
krist.vanbesien@gmail.com
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] 403 Forbidden error with rewrite [P] flag
Posted by Bruno Teixeira <br...@gmail.com>.
Hi there,
I didn't use AllowCONNECT. The problem was that I loaded the module with
"a2enmod" and the default configuration is "deny from all". Anyway, it
works now but, the address at the top changes to the redirected
address... Shouldn' it always keep the original address? This is a
problem, because in the future only the original IP address will be
"external".
Thank you for your time.
Bruno Teixeira
Chirouze Olivier wrote:
> Hi,
>
> I already had this but can't manage to find back the solution.
>
> I have two clues, thought:
>
> - you should have ProxyRequests Off to both of your virtualhosts (or at
> least, the first one).
> - I guess you did, but just in case, did you load module
> "proxy_http_module"?
>
> Last thing, I've recently found directive "AllowCONNECT", haven't had
> time to play with it, but that might be useful. (Might also need
> mod_proxy_connect).
>
> Please tell us if one of these helped!
>
> Olivier
>
> Olivier CHIROUZE
> I&0 Infrastructure
> Volvo Information Technology
>
>
>> -----Original Message-----
>> From: Bruno Teixeira [mailto:brunoteixa@gmail.com]
>> Sent: 16 February 2007 13:17
>> To: users@httpd.apache.org
>> Subject: [users@httpd] 403 Forbidden error with rewrite [P] flag
>>
>> Hi there,
>>
>> I've been browsing the web for a solution to my problem, but all I can
>> find are similar problems, no solutions...
>>
>> I am using a rewrite rule to rewrite "http://192.168.2.251/secure"
>> requests to "https://192.168.2.198/". This works fine, but I don't the
>> user to see the "198 IP", but to always the "251". To
>> accomplish this, I
>> thought I only had to add a "P flag" to the rewrite rule, but
>> when I do
>> so, I get a "403 Forbidden error". I have the proxy module loaded!
>>
>> I would really appreciate some input. Thank you for your time.
>>
>> I get this on the error log:
>>
>> [Fri Feb 16 11:13:14 2007] [error] [client 192.168.2.251]
>> client denied
>> by server configuration: proxy:https://192.168.2.198
>>
>> and this on the rewrite log:
>>
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) init
>> rewrite engine
>> with requested uri /secure
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) rewrite
>> /secure ->
>> https://192.168.2.198
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) forcing
>> proxy-throughput with https://192.168.2.198
>> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
>> [192.168.2.251/sid#8162818][rid#82a2440/initial] (1) go-ahead
>> with proxy
>> request proxy:https://192.168.2.198 [OK]
>>
>>
>> Here are both of the Virtual hosts:
>>
>> <VirtualHost 192.168.2.251:80>
>> ServerAdmin webmaster@localhost
>> ServerName 192.168.2.251
>> DocumentRoot /var/www/
>> <Directory />
>> Options FollowSymLinks
>> AllowOverride None
>> </Directory>
>> <Directory /var/www/>
>> Options Indexes FollowSymLinks MultiViews
>> AllowOverride None
>> Order allow,deny
>> allow from all
>> # Uncomment this directive is you want to see apache2's
>> # default start page (in /apache2-default) when
>> you go to /
>> RedirectMatch ^/$ /site
>> </Directory>
>>
>> ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
>> <Directory "/usr/lib/cgi-bin">
>> AllowOverride None
>> Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
>> Order allow,deny
>> Allow from all
>> </Directory>
>>
>> ErrorLog /var/log/apache2/error.log
>>
>> # Possible values include: debug, info, notice, warn,
>> error, crit,
>> # alert, emerg.
>> LogLevel warn
>>
>> CustomLog /var/log/apache2/access.log combined
>> ServerSignature On
>>
>> RewriteEngine on
>> RewriteCond %{SERVER_PORT} ^80$
>> RewriteRule ^/secure(.*)$ https://192.168.2.198$1 [L]
>> # RewriteRule ^/secure(.*)$ https://192.168.2.198$1
>> [L,P] this rule
>> gives the error
>> RewriteLog "/var/log/apache2/rewrite.log"
>> RewriteLogLevel 2
>>
>> Alias /doc/ "/usr/share/doc/"
>> <Directory "/usr/share/doc/">
>> Options Indexes MultiViews FollowSymLinks
>> AllowOverride None
>> Order deny,allow
>> Deny from all
>> Allow from 127.0.0.0/255.0.0.0 ::1/128
>> </Directory>
>> </VirtualHost>
>>
>>
>> <VirtualHost 192.168.2.198:443>
>> ServerAdmin webmaster@localhost
>> ServerName 192.168.2.198
>>
>> SSLEngine On
>> SSLCertificateFile /etc/apache2/ssl/198.crt
>> SSLCertificateKeyFile /etc/apache2/ssl/198.key
>>
>>
>> DocumentRoot /var/www
>> <Directory />
>> Options FollowSymLinks
>> AllowOverride None
>> </Directory>
>> <Directory /var/www/>
>> Options FollowSymLinks MultiViews
>> AllowOverride None
>> Order allow,deny
>> allow from all
>> RedirectMatch ^/$ /site
>> </Directory>
>>
>> ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
>> <Directory "/usr/lib/cgi-bin">
>> AllowOverride None
>> Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
>> Order allow,deny
>> Allow from all
>> </Directory>
>>
>> ErrorLog /var/log/apache2/error.log
>>
>> # Possible values include: debug, info, notice,
>> warn, error, crit,
>> # alert, emerg.
>> LogLevel warn
>>
>> CustomLog /var/log/apache2/access.log combined
>> ServerSignature On
>>
>> Alias /doc/ "/usr/share/doc/"
>> <Directory "/usr/share/doc/">
>> Options Indexes MultiViews FollowSymLinks
>> AllowOverride None
>> Order deny,allow
>> Deny from all
>> Allow from 127.0.0.0/255.0.0.0 ::1/128
>> </Directory>
>>
>> </VirtualHost>
>>
>>
>> Bruno Teixeira
>>
>>
>>
>>
>> ---------------------------------------------------------------------
>> The official User-To-User support forum of the Apache HTTP
>> Server Project.
>> See <URL:http://httpd.apache.org/userslist.html> for more info.
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] 403 Forbidden error with rewrite [P] flag
Posted by Chirouze Olivier <ol...@volvo.com>.
Hi,
I already had this but can't manage to find back the solution.
I have two clues, thought:
- you should have ProxyRequests Off to both of your virtualhosts (or at
least, the first one).
- I guess you did, but just in case, did you load module
"proxy_http_module"?
Last thing, I've recently found directive "AllowCONNECT", haven't had
time to play with it, but that might be useful. (Might also need
mod_proxy_connect).
Please tell us if one of these helped!
Olivier
Olivier CHIROUZE
I&0 Infrastructure
Volvo Information Technology
> -----Original Message-----
> From: Bruno Teixeira [mailto:brunoteixa@gmail.com]
> Sent: 16 February 2007 13:17
> To: users@httpd.apache.org
> Subject: [users@httpd] 403 Forbidden error with rewrite [P] flag
>
> Hi there,
>
> I've been browsing the web for a solution to my problem, but all I can
> find are similar problems, no solutions...
>
> I am using a rewrite rule to rewrite "http://192.168.2.251/secure"
> requests to "https://192.168.2.198/". This works fine, but I don't the
> user to see the "198 IP", but to always the "251". To
> accomplish this, I
> thought I only had to add a "P flag" to the rewrite rule, but
> when I do
> so, I get a "403 Forbidden error". I have the proxy module loaded!
>
> I would really appreciate some input. Thank you for your time.
>
> I get this on the error log:
>
> [Fri Feb 16 11:13:14 2007] [error] [client 192.168.2.251]
> client denied
> by server configuration: proxy:https://192.168.2.198
>
> and this on the rewrite log:
>
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) init
> rewrite engine
> with requested uri /secure
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) rewrite
> /secure ->
> https://192.168.2.198
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (2) forcing
> proxy-throughput with https://192.168.2.198
> 192.168.2.251 - - [16/Feb/2007:11:16:04 +0000]
> [192.168.2.251/sid#8162818][rid#82a2440/initial] (1) go-ahead
> with proxy
> request proxy:https://192.168.2.198 [OK]
>
>
> Here are both of the Virtual hosts:
>
> <VirtualHost 192.168.2.251:80>
> ServerAdmin webmaster@localhost
> ServerName 192.168.2.251
> DocumentRoot /var/www/
> <Directory />
> Options FollowSymLinks
> AllowOverride None
> </Directory>
> <Directory /var/www/>
> Options Indexes FollowSymLinks MultiViews
> AllowOverride None
> Order allow,deny
> allow from all
> # Uncomment this directive is you want to see apache2's
> # default start page (in /apache2-default) when
> you go to /
> RedirectMatch ^/$ /site
> </Directory>
>
> ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
> <Directory "/usr/lib/cgi-bin">
> AllowOverride None
> Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
> Order allow,deny
> Allow from all
> </Directory>
>
> ErrorLog /var/log/apache2/error.log
>
> # Possible values include: debug, info, notice, warn,
> error, crit,
> # alert, emerg.
> LogLevel warn
>
> CustomLog /var/log/apache2/access.log combined
> ServerSignature On
>
> RewriteEngine on
> RewriteCond %{SERVER_PORT} ^80$
> RewriteRule ^/secure(.*)$ https://192.168.2.198$1 [L]
> # RewriteRule ^/secure(.*)$ https://192.168.2.198$1
> [L,P] this rule
> gives the error
> RewriteLog "/var/log/apache2/rewrite.log"
> RewriteLogLevel 2
>
> Alias /doc/ "/usr/share/doc/"
> <Directory "/usr/share/doc/">
> Options Indexes MultiViews FollowSymLinks
> AllowOverride None
> Order deny,allow
> Deny from all
> Allow from 127.0.0.0/255.0.0.0 ::1/128
> </Directory>
> </VirtualHost>
>
>
> <VirtualHost 192.168.2.198:443>
> ServerAdmin webmaster@localhost
> ServerName 192.168.2.198
>
> SSLEngine On
> SSLCertificateFile /etc/apache2/ssl/198.crt
> SSLCertificateKeyFile /etc/apache2/ssl/198.key
>
>
> DocumentRoot /var/www
> <Directory />
> Options FollowSymLinks
> AllowOverride None
> </Directory>
> <Directory /var/www/>
> Options FollowSymLinks MultiViews
> AllowOverride None
> Order allow,deny
> allow from all
> RedirectMatch ^/$ /site
> </Directory>
>
> ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
> <Directory "/usr/lib/cgi-bin">
> AllowOverride None
> Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
> Order allow,deny
> Allow from all
> </Directory>
>
> ErrorLog /var/log/apache2/error.log
>
> # Possible values include: debug, info, notice,
> warn, error, crit,
> # alert, emerg.
> LogLevel warn
>
> CustomLog /var/log/apache2/access.log combined
> ServerSignature On
>
> Alias /doc/ "/usr/share/doc/"
> <Directory "/usr/share/doc/">
> Options Indexes MultiViews FollowSymLinks
> AllowOverride None
> Order deny,allow
> Deny from all
> Allow from 127.0.0.0/255.0.0.0 ::1/128
> </Directory>
>
> </VirtualHost>
>
>
> Bruno Teixeira
>
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org