2.6K

Introduction

If your website uses Incapsula and visitors see a “Site Unreachable” error, the issue is usually due to firewall or traffic-filtering settings. Incapsula works as a reverse proxy and web application firewall. It directs all website traffic through its secure network before it reaches your server. This improves security and performance, but misconfigured firewalls or rate-limiting systems can flag Incapsula traffic as suspicious and block legitimate requests.

In this blog, we will explain why the “Site Unreachable via Incapsula” error occurs and how to configure your server to allow traffic from Incapsula’s IP ranges.

Site Unreachable Error

This error may occur if the website uses Incapsula for maintaining traffic.
Incapsula provides every website, regardless of its size, with an enterprise-grade PCI-certified Web Application Security, ensuring your website is safe and available. Upon completing the DNS changes outlined by Incapsula, you are effectively directing all your traffic through Incapsula’s network of proxy servers (Incapsula proxies). Incapsula proxies access to your servers and then serves content to site visitors. Requests to your servers are therefore all coming from a limited range of Incapsula IP addresses. This may result in being classified as attack traffic by various traffic-limiting mechanisms and denying Incapsula access to your servers.
To ensure that traffic to your website passes through Incapsula, you can limit access to it from non-Incapsula IP addresses.
To do this, apply a set of rules to your firewall (or your .htaccess files) that block all traffic from non-Incapsula IP addresses. If a firewall or rate-limiting mechanism is blocking access, please contact your hosting provider to whitelist Incapsula’s IP ranges.

199.83.128.1 – 199.83.135.254
198.143.32.1 – 198.143.63.254
149.126.72.1 – 149.126.79.254
103.28.248.1 – 103.28.251.254
185.11.124.1 – 185.11.127.254

This list may change from time to time.
In order to allow all traffic coming from Incapsula IPs and deny any access from non-Incapsula IPs, insert the following lines into your .htaccess file:

order deny,allow
deny from all
allow from IP1/Mask1
allow from IP2/Mask2

 

Conclusion

Incapsula offers high-quality website security, DDoS protection, and traffic optimization by routing requests through its proxy network. However, if your firewall, rate-limiting system, or server security rules block Incapsula IP addresses, visitors may not be able to access your website.

To avoid this issue, make sure to whitelist all current Incapsula IP ranges on your firewall or web server. Regularly check Incapsula’s documentation for any updates to their IP addresses. Properly setting up these rules will help keep your website available while maintaining the security benefits that Incapsula offers.

If you require help, contact SupportPRO Server Admin