# Disallow Mautic access remotely but allow unsubscribe link

**URL:** <https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479>\
**Category:** Product Support\
**Created:** [April 1, 2022, 4:03pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479 "2022-04-01T16:03:07Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![dspraker](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dspraker/32/7277_2.png) [@dspraker](https://forum.mautic.org/u/dspraker)\
**Post date:** [April 1, 2022, 4:03pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/1 "2022-04-01T16:03:07Z")

</div>

**Your software**  
My Mautic version is: v3.3.5  
My PHP version is: 7.3.33  
My Database type and version is: MariaDB 10.5.15  
My Webserver is: Apache v2.4.6

My problem is:

Very simple question. Does anyone have a quick .htaccess snippet or another method to disallow remote access to Mautic, but still allow the campaign ‘Unsubscribe’ links to work? (Ie. to “[http://mymautic.example.com/email/unsubscribe/xxxxxxxxxx](http://mymautic.example.com/email/unsubscribe/xxxxxxxxxx)”)

I imagine it’s very simple, but I’m not finding an example and quite honestly Apache directives make my head hurt. 🙂

Essentially I’m looking for src: 192.168.0.0/16 to be allowed to the dashboard, anything else only allow access to the email unsubscribe link.

Thank you!

---

<div class="post-metadata">

**Author:** ![pierre\_a](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/pierre_a/32/7031_2.png) [@pierre\_a](https://forum.mautic.org/u/pierre_a)\
**Post date:** [April 1, 2022, 4:14pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/2 "2022-04-01T16:14:30Z")

</div>

Hello @dspraker,

If I understand correctly you want to :

- Make the URL [http://mymautic.example.com/email/unsubscribe/xxxxxxxxxx](http://mymautic.example.com/email/unsubscribe/xxxxxxxxxx) accessible
- Make the URL [http://mymautic.example.com/](http://mymautic.example.com/) not accessible.

Is this correct?

Pierre

---

<div class="post-metadata">

**Author:** ![dspraker](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dspraker/32/7277_2.png) [@dspraker](https://forum.mautic.org/u/dspraker)\
**Post date:** [April 1, 2022, 5:23pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/3 "2022-04-01T17:23:31Z")

</div>

Exactly. The /email/unsubscribe is sent out via the campaign emails, and that is the only type of external access I would like.

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [April 1, 2022, 6:13pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/4 "2022-04-01T18:13:42Z")

</div>

I am not an expert at apache but I think what you are looking for is something like - this is not tested:

```auto
  # Except those allowed below.
    <If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">
        Order allow,deny
        Deny from all
        Allow from [your IP]
    </If>

    <If "%{REQUEST_URI} =~ ^/email/unsubscribe/(.+)$">
        Order allow,deny
        Allow from all
    </If>

```

---

<div class="post-metadata">

**Author:** ![dspraker](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dspraker/32/7277_2.png) [@dspraker](https://forum.mautic.org/u/dspraker)\
**Post date:** [April 1, 2022, 8:54pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/5 "2022-04-01T20:54:36Z")

</div>

Well, it looks valid, but you’re right… not working. I get:

`[Fri Apr 01 16:52:10.036466 2022] [core:alert] [pid 9930] [client 192.168.xx.xx:50518] /var/www/html/.htaccess: Cannot parse condition clause: syntax error, unexpected T_ERROR, expecting T_REGEX or T_REGEX_I: Parse error near '^', referer: http://192.168.xx.xx/`

Because the .htaccess is just a bunch of rewrite modules, I just put them into the top. Look valid?

```auto
# Use the front controller as index file. It serves as a fallback solution when
# every other rewrite/redirect fails (e.g. in an aliased environment without
# mod_rewrite). Additionally, this reduces the matching process for the
# start page (path "/") because otherwise Apache will apply the rewriting rules
# to each configured DirectoryIndex file (e.g. index.php, index.html, index.pl).
#DirectoryIndex index.php

    <If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">
        Order allow,deny
        Deny from all
        Allow from 192.168.0.0/16
    </If>

    <If "%{REQUEST_URI} =~ ^/email/unsubscribe/(.+)$">
        Order allow,deny
        Allow from all
    </If>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Set Authorization header for OAuth1a for when php is running under fcgi
    RewriteCond %{HTTP:Authorization} .+
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

```

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [April 3, 2022, 9:27am UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/6 "2022-04-03T09:27:11Z")

</div>

Actually if you investigate the original mautic .htaccess file you will see that the first if block is already there:

> [@dspraker](#):
>
> `<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">`

just see what the body has originally and make sure its the same as what I have posted.

Now you also have to add the second if block after that, **but** based on the error message you posted and the apache docs it looks like I did not enclose the regex, so try adding this block after the edited one:

```auto
<If "%{REQUEST_URI} =~ m#^/email/unsubscribe/(.+)$#">
        Order allow,deny
        Allow from all
    </If>

```

If this still does not work, let me know, I will try to test it myself (although I am not using apache).

---

<div class="post-metadata">

**Author:** ![dspraker](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dspraker/32/7277_2.png) [@dspraker](https://forum.mautic.org/u/dspraker)\
**Post date:** [April 4, 2022, 2:19pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/7 "2022-04-04T14:19:29Z")

</div>

Still not working, but differently. Apparently the newer versions of Apache have changed the directives:

```auto
    <If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">
        Require ip 192.168.0.0/16
    </If>

    <If "%{REQUEST_URI} =~ m#^/email/unsubscribe/(.+)$#">
        Require all granted
    </If>

```

This works fine for blocking access to the dashboard (Thanks for the info on the regexes!), but it’s also blocking access to the unsubscribe link.

`http:/xxxxxxx.xxxxxxxx.xxx/email/unsubscribe/621fd775708fa422323133` now gives:

> # Forbidden
> 
> You don’t have permission to access /index.php on this server.

`[Mon Apr 04 10:14:50.603602 2022] [authz_core:error] [pid 27955] [client 184.xxx.xxx.xxx:40802] AH01630: client denied by server configuration: /var/www/html/index.php`

So apparently it’s redirecting the unsubscribe link through the primary index.php, but that’s being blocked by the other block

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [April 5, 2022, 8:17am UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/8 "2022-04-05T08:17:50Z")

</div>

I have tried this yesterday, this time via RewriteEngine and still was not successful, sorry, but I think somwhere in direction I have shown must be the solution. Will post here if I find the solution.

---

<div class="post-metadata">

**Author:** ![dspraker](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dspraker/32/7277_2.png) [@dspraker](https://forum.mautic.org/u/dspraker)\
**Post date:** [April 5, 2022, 2:50pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/9 "2022-04-05T14:50:40Z")

</div>

Thanks. It seems like an obvious thing that I think most people would want by default… allow people to unsubscribe, but not allow them to try to login/hack the Admin panel.

If you can think of anything please do let me know, and thank you again for looking at it

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [April 5, 2022, 10:16pm UTC](https://forum.mautic.org/t/disallow-mautic-access-remotely-but-allow-unsubscribe-link/23479/10 "2022-04-05T22:16:50Z")

</div>

Yeah in general you do not want to block all the access since tracking will also not work. There are other ways to strengthen the defense.

Like:

- fail2ban
- block access to sites on app level (its not the right way to do this - the apache is)
- proper server monitoring
- etc.