How to whitelist an IP address in ModSecurity

Question

How do I  whitelist an IP in ModSecurity?

Answer

1. Log in to SSH or Terminal as the root user.

2. Open the following file in a text editor:

   # /etc/apache2/conf.d/modsec/modsec2.user.conf

3. Add one or more of the following example variants to the bottom of the file, but edit it to contain your desired IP address:

   # Single IP example
   # Allow unrestricted access from 192.0.2.1 
   SecRule REMOTE_ADDR "@ipMatch 192.0.2.1" "phase:1,id:200000001,nolog,allow"

   # Multi IP Example
   # Allow unrestricted access from 192.0.2.1,192.0.2.2,198.51.100.0/24
   SecRule REMOTE_ADDR "@ipMatch 192.0.2.1,192.0.2.2,198.51.100.0/24" "phase:1,id:200000001,nolog,allow

   Note: The IP format documentation can be found here: ModSecurity Reference Manual - @ipmatch.

4. Restart Apache:

   # /scripts/restartsrv_apache --restart

Additional Resources

ModSecurity® Configuration