# Restrict access by IP address

**URL:** <https://www.ruby-forum.com/t/restrict-access-by-ip-address/93108>\
**Category:** Deployment\
**Created:** [April 27, 2007, 5:21pm UTC](https://www.ruby-forum.com/t/restrict-access-by-ip-address/93108 "2007-04-27T17:21:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![milo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/85e7bf/32.png) [@milo](https://www.ruby-forum.com/u/milo)\
**Post date:** [April 27, 2007, 5:21pm UTC](https://www.ruby-forum.com/t/restrict-access-by-ip-address/93108/1 "2007-04-27T17:21:55Z")

</div>

I’d like to restrict access to some controllers of my app to certain IP  
addresses only, but can’t find any information on this. Can anyone  
suggest a good way to go about this?  
All I could think of was adding a entry to public/.htaccess,  
but that appears not to work.

---

<div class="post-metadata">

**Author:** ![milo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/85e7bf/32.png) [@milo](https://www.ruby-forum.com/u/milo)\
**Post date:** [April 27, 2007, 6:16pm UTC](https://www.ruby-forum.com/t/restrict-access-by-ip-address/93108/2 "2007-04-27T18:16:36Z")

</div>

> I’d like to restrict access to some controllers of my app to certain IP  
> addresses only, but can’t find any information on this. Can anyone  
> suggest a good way to go about this?  
> All I could think of was adding a entry to public/.htaccess,  
> but that appears not to work.

You could write a before\_filter for those controllers and check the  
environment hash for the IP and if it doesn’t match return false.

---

<div class="post-metadata">

**Author:** ![milo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/85e7bf/32.png) [@milo](https://www.ruby-forum.com/u/milo)\
**Post date:** [April 27, 2007, 6:22pm UTC](https://www.ruby-forum.com/t/restrict-access-by-ip-address/93108/3 "2007-04-27T18:22:43Z")

</div>

Philip H. wrote:

> You could write a before\_filter for those controllers and check the  
> environment hash for the IP and if it doesn’t match return false.

Thanks. I have tried a simple one like this:

if request.remote\_ip !~ /^XXX.YYY.ZZZ./  
redirect\_to ‘/’  
flash.now[:notice] = “Access denied!”  
return false  
end

That seems to work, but I wondered if there might be another way. If  
this is the accepted method then that’s OK, though.

---

<div class="post-metadata">

**Author:** ![milo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/85e7bf/32.png) [@milo](https://www.ruby-forum.com/u/milo)\
**Post date:** [April 27, 2007, 6:26pm UTC](https://www.ruby-forum.com/t/restrict-access-by-ip-address/93108/4 "2007-04-27T18:26:37Z")

</div>

In the main application controller, we read a small text file  
containing IP addresses then set a flag if the current IP address  
matches anything in the file:

not the best code, but it works:

# begin

@ipflag = false  
File.open(RAILS\_ROOT + ‘/config/iplist.txt’, ‘r’).each do |line|  
@ipflag = true if request.remote\_addr.to\_str == ip.strip.to\_str  
end

# end

then in your controlles use @ipflag appropriately.

No doubt you could also check for partial addresses with a regex to  
deal with parts of a class. As I said not the most complete thing, but  
something similar to the above works for us to block whatever  
miscreants we need to 🙂

- Ericson S.  
[http://www.funadvice.com](http://www.funadvice.com)