Cannot enable Magento 2 maintenance mode excluding a specific IP

Question

I have a magento2 web application which I need to enable maintenance mode excluding a specific IP. The following command did enable the maintenance mode without excluding my IP.

php bin/magento maintenance:enable --ip=123.45.67.89

and I tried the following since the above command didn't work.

php bin/magento maintenance:allow-ips 123.45.67.89

var/.maintenance.ip does exist and it has my ip listed in it.

Answer 1

Are you by any chance using varnish or another reverse proxy? ie, it might be that your public IP does not get forwarded, and therefore cannot be recognised. Easiest check is the access logs on the webserver, see if you can see your own IP in there. Otherwise you'll have to implemented x-forwarded-for headers

Answer 2

The typically maintenance mode will not work since your real IP is coming through as a forwarded IP due to the Haproxy/ Varnish setup. Try to create a maintenance page and directing all traffic, except for a few whitelisted IPs, to that page.

RewriteEngine on
RewriteCond %{HTTP:X-FORWARDED-FOR} !^123\.45\.67\.89
RewriteCond %{REQUEST_URI} !/maintenance.php$ [NC]
RewriteRule .* /maintenance.php [R=302,L]

Answer 3

I might be late for this topic, but today I've had the same issue for Magento 2.3.6, served by an Apache2 server.

Even if @TA3 does not specify which web server software he's using, my post here will bring a answer to do it with Apache2 servers.

As @Marcel said, the reverse proxy in front of your Magento app must forward a HTTP header revealing the real client IP address. It can be X-Forwarded-For or X-Real-IP, depending on the configuration of the reverse proxy. It is the only way for the final web server to know which is the IP address of the visitor.

For my part, I have 2 HAProxy instances in front of my Apache2 servers & each instance is setup on a different machine for a HA setup, all of them on Debian 10.

1. On the web servers, I've enabled the remoteip module in apache2 :

root@web-server01:~# a2enmod remoteip

2. Then, I've declared which HTTP header I'm using (X-Forwarded-For in my case) & added the IP address of my reverse proxies in /etc/apache2/apache2.conf, just before the end of the file :

RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy <IP_OF_HAPROXY-01> <IP_OF_HAPROXY-02>

(Replace <IP_OF_HAPROXY-0x> by the real IP addresses of your reverse proxies ;-) )

3. Finally, restart apache2 service

root@web-server01:~# systemctl restart apache2

And don't forget to repeat this config on each web server you have.

Now, the maintenance mode should exempt the IP address you want :

php bin/magento maintenance:enable --ip=123.45.67.89

Hope this helps.

Answer 4

I can exclude ips from maintenance mode, by give below steps

1- php bin/magento maintenance:allow-ips MY_IP_ADDRESS

2- php bin/magento maintenance:enable

After running these two commands, I can see the maintenance mode is not enable for me.