RumorMill Help

Restrictions Help

Introduction

Restrictions let you limit which other computers have access to your RumorMill server. You need not use restrictions unless limiting access is important to you. Computers are restricted on the basis of their IP address. The default RumorMill configuration has a default mask permitting access by computers in the same subnet as the server (that is, the first three numbers in the IP address must match the server's).

Details

For instance, if the server is at the IP address 1.2.3.4, then by default any client coming from a machine with IP addresses between 1.2.3.1 and 1.2.3.255 can connect to the server. A computer with IP address 5.6.7.8 would not be permitted to connect. The IP mask for this configuration is 1.2.3.4/255.255.255.0. (The mask makes a lot more sense if you consider it as a binary number: 255 is 11111111 in binary, 0 is 00000000. 255 means match all bits, 0 means match no bits.)

More complex masks can be used like, 127.2.3.4/1.255.0.255, which would match all IP addresses between 1.2.1.4 and 1.2.255.4, 3.2.1.4 and 3.2.255.4, 5.2.1.4 and 5.2.1.4 and so on (that is the first number is odd and the remaining three are between .2.1.4 and .2.255.4).

The ordering of the IP masks is important: RumorMill starts at the top of the list and stops as soon as it finds a mask which specifically permits or denies the IP address. If it reaches the end of the list without specific reference the IP address is denied. Generally speaking more specific masks should be placed above more general masks.

RumorMill also adds a mask for each of the servers defined in the Newsfeed window (otherwise they would not be able to feed articles to RumorMill, and RumorMill would not feed articles to the Newsfeed). These masks will not show up in the Site Restrictions window because RumorMill generates them dynamically using a DNS lookup when it is run. That means that even if the server changes IP address RumorMill will (eventually!) allow it to connect (that is, as soon as RumorMill is reset).

Note: A finite number of Site Restrictions masks can be specified. The current maximum is 20.

The Site Restrictions window also allows you to check whether a particular IP address is permitted or denied using the Test IP address, which tests against the current list of masks.

Note that it is not possible to check against DNS names, for example, news.swaystairs.com, and use these to prohibit access. This is because DNS names can be 'spoofed' by other machines, that is pretends to be our example news.swaystairs.com, and thus DNS names are not secure way of restricting access.

Some Example Masks:

Address Mask Deny? Description
1.2.3.0 255.255.255.0 Permit Permits all access in the C-Class domain 1.2.3
0.0.0.0 0.0.0.0 Permit Permits access to any connecting host
1.2.3.128 255.255.255.128 Permit Permits any host with an IP address of 1.2.3.128 or greater to connect.
0.0.0.1 0.0.0.255 Permit Permits any host with an IP address whose last byte is equal to 1 to connect (eg 5.6.7.1, but not 5.6.7.81)
153.10.8.9 255.255.255.255 Deny Denies access to the host at address 153.10.8.9

Using the Restrictions page

Add...

Clicking the Add button will bring up another page that allows a new restriction to be defined.

Edit...

Selecting an existing restriction and then clicking the Edit button will bring up another page that allows the selected restriction to be modified.

Delete

Delete will remove the selected restriction.

Duplicate...

When a restriction is selected, the Duplicate button will create a new restriction based on the selected one and bring up a new page to allow editing of this duplicated restriction.

Reset

Deselects any selected restriction.

Restrictions ordering

As described above, the order of restrictions is significant. The Up and Down buttons described below allow the order of restrictions to be rearranged.

Up

The Up button moves the selected restriction upward in the list of restrictions.

Down

The Down button moves the selected restriction downward in the list of restrictions.

Test Address

By entering a specific IP address in the test address field and pressing the Test button, RumorMill will check that address against the current list of restrictions and report whether or not that address will be allowed or denied.