Links to IP addresses do not work

[parikshit-parspec]

Hi, I have set up Yourls on a Linux 20.04 GCP instance. All functionality is working well. I can create short URLs to websites and access them. However, if I create a short URL that points to an IP address (eg, http://89.65.34.22), the short URL returns a 403 forbidden error. The link is accessible directly without problems.

[ozh]

What do you mean "the short URL returns a 403 forbidden error" ?

YOURLS doesn't care what you shorten, it can be http://localhost/, http://my.computer.dev, http://12.12.12.12, non http links, etc

[parikshit-parspec]

If I type http://12.12.12.12 in my browser, I am taken to the webpage hosted on that IP. However if I shorten http://12.12.12.12 to my.domain/gothere, then visiting the short URL gives me a 403 error.

Other links work fine. For example I can shorten http://www.google.com to my.domain/goog it works.

[dgw]

What Ozh said. But I wonder if this is some security configuration that came pre-installed on your version of Apache.

I missed the GCP instance mention in the OP. Ignore the below.

If you're using Apache managed by some other provider (i.e. not running your own on a VPS or other private server), I'd try contacting your host's support service. They might have security rules in place that prevent hosted sites from redirecting to bare IPs, perhaps because a lot of malware uses bare IPs for downloads or C&C.

[parikshit-parspec]

When I enter the short URL into my address bar like http://my.domain/gothere, I get a 403 forbidden from the Apache server that is hosting the YOURLS instance. When I visit the destination directly by entering http://12.12.12.12 into the address bar, it works fine.

The IP is internal and my YOURLS/Apache GCP instance is only accessible within my network. So the actual IP won't be of help to you.

I have a feeling that there is some Apache config (security or otherwise) that is causing this problem. I just don't know where to look to find out the problem and fix it.

In any case, thanks for your responses. I will try to find out more about Apache config etc.

[dgw]

The IP is internal

This is a key piece of information, and points even more strongly to some security configuration/plugin in Apache. I'm just having trouble finding anything relevant in search due to how many pages talk about redirecting bare IPs to the domain name. 😩

Examining your Apache configuration and list of enabled modules will help a lot more than my random googling anyway :)

[ozh]

This might be a mod_security, or similar, issue. For instance, on my test box I can shorten http://151.101.1.140/ and everything behaves normally. But on http://yourls.org/admin/ I cannot because the server halts the ajax request with a 418 http error, usually triggered when the server is configured to stop what might be an illegal request / spoof attempt / etc

So, yes, server config.

If you intend to shorten lots of IP, a fix could be a plugin that would strip "http(s)://" from IP URL before sending them to the server (if https://sho.rt/admin/admin-ajax.php?action=add&url=http://151.101.1.140&nonce=... fails, I bet that ``https://sho.rt/admin/admin-ajax.php?action=add&url=151.101.1.140&nonce=...` will pass) and glue it back afterwards.

[parikshit-parspec]

I ran the GET request using Postman, and that returned the destination page perfectly. That got me thinking about the trailing / in the long URL field. I removed it and now it works. Ultimately I think it is some config in the server that is not set up correctly. Thanks for the help.