Hardening CWP: How to Block IP-Based Bot Scans Using Apache Catch-All Rules

If you manage a CWP (Control Web Panel) server, you are probably all too familiar with the endless flood of 127.0.0.1 requests in your cwpsrv access logs. Malicious bots constantly scan for vulnerable files like .env, .git, or /wp-json/.

When a bot hits your server’s IP address directly instead of using a domain name, Apache—depending on CWP’s default routing—often forwards that request internally to the CWP panel. Because the request originates from the server itself during this proxy jump, it gets logged as 127.0.0.1, creating massive log clutter and masking real security threats.

Instead of playing whack-a-mole with a blacklist of specific keywords (which is a losing battle), the most robust solution is to block all direct IP-based requests at the Apache level.

Here is the step-by-step guide to implementing an Apache “Catch-All” rule to neutralize these bots and clean up your CWP logs.

Step 1: Backup Your Apache Configuration

As a golden rule of server administration, always create a backup before making structural changes. Run the following command in your terminal:

bash

cp /usr/local/apache/conf/httpd.conf /root/httpd.conf.bak

Step 2: Create a Custom Catch-All Configuration File

Apache reads configuration files in the /usr/local/apache/conf.d/ directory alphabetically. To ensure our custom rule takes precedence without being overridden, we will create a new file prefixed with zz-.

bash

nano /usr/local/apache/conf.d/zz-catchall-ip.conf

Step 3: Implement the IP Blocking Rules

Paste the following configuration block into the empty file.

(Important: Replace 198.0.0.0 with your actual server’s public IP address).

apache

# --- Block Direct IP Access on Port 80 (HTTP) ---
<VirtualHost *:80>
    ServerName 198.0.0.0
    RewriteEngine On
    
    # If the Host header matches the IP address OR is empty, issue a 403 Forbidden
    RewriteCond %{HTTP_HOST} ^198\.0\.0\.0$ [NC,OR]
    RewriteCond %{HTTP_HOST} ^$
    RewriteRule ^ - [F,L]
</VirtualHost>

# --- Block Direct IP Access on Port 443 (HTTPS) ---
<VirtualHost *:443>
    ServerName 198.0.0.0
    SSLEngine on
    # Using the default CWP self-signed cert. Update paths if you use custom certs.
    SSLCertificateFile /etc/pki/tls/certs/hostname.crt
    SSLCertificateKeyFile /etc/pki/tls/private/hostname.key
    
    RewriteEngine On
    
    # If the Host header matches the IP address OR is empty, issue a 403 Forbidden
    RewriteCond %{HTTP_HOST} ^198\.0\.0\.0$ [NC,OR]
    RewriteCond %{HTTP_HOST} ^$
    RewriteRule ^ - [F,L]
</VirtualHost>

Why this works: Legitimate visitors and search engine crawlers use your domain name (e.g., https://yourdomain.com). Bot scanners, however, often target the IP directly (e.g., http://198.0.0.0/.env) or send malformed Host headers. This configuration tells Apache: “If the request is not for a valid domain name, drop it immediately with a 403 Forbidden error.”

Step 4: Verify Configuration and Restart Apache

Before restarting, check for syntax errors to ensure you don’t accidentally take down your web server:

bash

httpd -t

If the output says Syntax OK, safely apply the changes by restarting Apache:

bash

systemctl restart httpd

Step 5: Test and Monitor

Test the rule by simulating a bot request using curl:

bash

curl -I http://198.0.0.0/.env

You should receive a HTTP/1.1 403 Forbidden response.

Finally, monitor your CWP logs in real-time:

bash

tail -f /usr/local/cwpsrv/logs/access_log

You will notice that the 127.0.0.1 bot spam has essentially vanished. Your CWP logs will now only display legitimate administrator login attempts and true traffic.

💡 Will This Break RustDesk or Other Services?

No. This configuration only affects Apache’s handling of HTTP (Port 80) and HTTPS (Port 443) traffic. Services like RustDesk (which uses ports 21115-21119), MySQL (Port 3306), or custom SSH daemons operate on their own dedicated ports and remain completely unaffected by Apache’s web rules.

The Bottom Line

Security by obscurity or blocking specific keywords is not enough. By enforcing strict IP-based rejections at the Apache level, you eliminate 99% of automated noise, stop direct-to-IP exploit attempts, and keep your CWP server logs pristine and actionable.

Scroll to Top