I need to block every IP address from accessing my site except one or two IP's provided by myself. I have tried many modules but nothing seems to work.

var express = require('express')
var AccessControl = require('express-ip-access-control');
var app = express()

app.get('/', function (req, res) {
  res.send('Hello World!')
})

var middleware = AccessControl(options);
 app.use(AccessControl(options));

var options = {
    mode: 'deny',
    denys: [],
    allows: ['**8.1**.1.**'],
    forceConnectionAddress: false,
    log: function(clientIp, access) {
        console.log(clientIp + (access ? ' accessed.' : ' denied.'));
    },

    statusCode: 401,
    redirectTo: '',
    message: 'Unauthorized'
};

app.listen(3000, function () {
  console.log(' app listening on port 3000!')
})

on running and accessing my site from my above code i am getting the console message as

::ffff:127.0.0.1 accessed.
::ffff:127.0.0.1 accessed.
::ffff:127.0.0.1 accessed.
::ffff:127.0.0.1 accessed.

any help?

I need to block every IP address from accessing my site except one or two IP's provided by myself. I have tried many modules but nothing seems to work.

var express = require('express')
var AccessControl = require('express-ip-access-control');
var app = express()

app.get('/', function (req, res) {
  res.send('Hello World!')
})

var middleware = AccessControl(options);
 app.use(AccessControl(options));

var options = {
    mode: 'deny',
    denys: [],
    allows: ['**8.1**.1.**'],
    forceConnectionAddress: false,
    log: function(clientIp, access) {
        console.log(clientIp + (access ? ' accessed.' : ' denied.'));
    },

    statusCode: 401,
    redirectTo: '',
    message: 'Unauthorized'
};

app.listen(3000, function () {
  console.log(' app listening on port 3000!')
})

on running and accessing my site from my above code i am getting the console message as

::ffff:127.0.0.1 accessed.
::ffff:127.0.0.1 accessed.
::ffff:127.0.0.1 accessed.
::ffff:127.0.0.1 accessed.

any help?

• javascript
• node.js
• express

Share Follow edited May 9, 2017 at 9:39 Qix - MONICA WAS MISTREATED 15.2k1717 gold badges9292 silver badges156156 bronze badges asked May 9, 2017 at 9:27 JagadeeshJagadeesh 2,09799 gold badges2828 silver badges5151 bronze badges 8

• i didnt understand your code, make it clearly – G.Ashok Kumar Commented May 9, 2017 at 9:33
• 1 Read the fine manual: to implement a whitelist the mode should be "allow". – robertklep Commented May 9, 2017 at 9:35
• I haven't seen you put any ip in your allows – Beginner Commented May 9, 2017 at 9:35
• sry i have changed it now...yet same results – Jagadeesh Commented May 9, 2017 at 9:37
• i have also changed my mode and executed but i am getting the same results @robertklep. – Jagadeesh Commented May 9, 2017 at 9:39

 |  Show 3 more ments

2 Answers 2

Sorted by: Reset to default 6

You can simply add your own middleware that checks the IPs, no need to include another module.

You can see the ip from the request with req.connection.remoteAddress.

Before you define your routes, add something like this:

// Custom Middleware
app.use((req, res, next) => {
let validIps = ['::12', '127.0.0.1']; // Put your IP whitelist in this array

  if(validIps.includes(req.connection.remoteAddress)){
      // IP is ok, so go on
      console.log("IP ok");
      next();
  }
  else{
      // Invalid ip
      console.log("Bad IP: " + req.connection.remoteAddress);
      const err = new Error("Bad IP: " + req.connection.remoteAddress);
      next(err);
  }
})

This will throw an error if an invalid ip es in. Below all your routes, add something like this:

// Error handler
app.use((err, req, res, next) => {
    console.log('Error handler', err);
    res.status(err.status || 500);
    res.send("Something broke");
});

You need to define your options before you use them. Otherwise, you're passing in undefined to app.use(AccessControl(options)).

Not sure how this is piling for you, but adding the following line to the top of your script might help show a few more errors that would help.

'use strict';

---

Secondly, according to the express-ip-access-control documentation:

'allow' mode (Whilelist):

Deny by default, only allow IPs in the whitelist (allows) and not excluded by the blacklist (denys).

So change options.mode from 'deny' to 'allow'.