Can Apache listen on specific IP addresses for ports 80 and 443?

Virtualmin
1
SYSTEM INFORMATION
Version Webmin 2.660
Version Usermin 2.560
Version Virtualmin 8.2.0 GPL
Version Apache 2.4.68

Hi,

Is it risky to modify /etc/apache2/ports.conf, which currently contains:

Listen 80
Listen 443

and change it to something like:

Listen IP1:80
Listen IP2:80
Listen IP3:80
Listen IP1:443
Listen IP2:443
Listen IP3:443

I have around 10 different IPv4 addresses, and possibly another 10 IPv6 addresses with different suffixes.

The goal is to have Apache listen on ports 80 and 443 only on specific IP addresses, while reserving another dedicated IP address for a different (non-Apache) service that also needs to use port 443.

Does anyone know if Apache can work this way?

What are the potential risks or side effects?

Also, I’ve never tried modifying ports.conf before. Is this configuration actually supported and expected to work?

Thanks!

2

you set this in the vhost file

<VirtualHost IP-Address:Port>.

make sure the IP’s are assigned to the server then you can use virtualmin to manage it.

3

Sure, that’s how web servers used to work in the bad old days.

You need to be aware that Apache treats IP as the strongest matching characteristic, so if you switch to specifying IP addresses, you can no longer use *:80 for any VirtualHost on an IP that has an IP:80 VirtualHost, because in that case, the * host can never match.

I would generally recommend against wasting IPs like this, though.

4

I agree with Joe that it’s much easier to just use *:80 or *:443 to handle all requests.

That said, I think it will still work with *:80. It’s just that *:80 won’t match requests arriving on an IP that has a more specific IP:80 VirtualHost configured, which is actually the goal here.

And, I’m not sure why this approach is seen as old or bad practice. If the concern is that it may cause confusion or add complexity, then I agree that this is a good reason to avoid it. Otherwise, it’s just another type of server config—not good or bad.

5

Is this where a firewall and rules would be useful?

6

Because it wastes IPv4 addresses for no useful purpose.

To be clear: There’s nothing wrong with making Apache listen on only one IP and using that specific IP for all your VirtualHosts, so you can use the other IP(s) for other services. That (other services needing port 443) is maybe a useful purpose (though Apache could also proxy to it, so no additional IPs are needed).

But, there’s no reason to use a bunch of IP addresses for different VirtualHosts.

7

No. A firewall has nothing to do with Apache VirtualHosts.

8

What if one domain were involved in sending spam? With a private IP, the other domains on the system would not be affected. I remember that being the main reason each domain was justified in having its own IP.

9

That requires mail server configuration, not VirtualHost configuration.

10

Not for blocking, but policy routing. I used the wrong term as I call my pfsense a firewall, when in reality it is a router with firewall functionality.

11

That is true, though in the case of Virtualmin, it is all somewhat tied to a virtual server created with a private IP in the first place.

Anyway, to stay on track, using *:80 and *:443 either way is much simpler and easier to support, regardless of whether a private IP is used.

12

What I’m trying to do is keep my IPv4/IPv6 addresses separate. I have 10 IP addresses in total, and I’d like to use 9 of them with Apache, while using the 10th IP address for another daemon that is not Apache.

I don’t want to use Apache as a reverse proxy for the other daemon. The other daemon needs to listen directly on port 443, just like Apache does.

Ideally, I’d like to configure it like this:

<some_IPs_for_Apache>:80
<some_IPs_for_Apache>:443

<the_last_IP_for_the_other_daemon>:443

So, in short, Apache would listen on ports 80 and 443 on 9 IP addresses, while the other daemon would listen directly on port 443 on the remaining IP address.