Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an Apache reverse proxy that is currently reverse proxying for a few sites. However i am now going to be adding a new site (lets call it newsite.com) that should only be accessible by certain IP's. Is this doable using Apache as a reverse proxy?

I use VirtualHosts for the sites that are being proxyied. I have tried using the Allow/Deny directives in combination with the Location statements. For example:

<VirtualHost *:80>  
Servername newsite.com   
<Location http://newsite.com>
Order Deny,Allow
Deny from all
Allow from x.x.x.x
</Location>
<IfModule rewrite_module>
 RewriteRule ^/$ http://newsite.internal.com [proxy]
</IfModule>

I have also tried configuring allow/deny specicaily for the site in the Proxy directives, for example

<Proxy http://newsite.com/>
  Order deny,allow
  Deny from all
  Allow from x.x.x.x
</Proxy>

I still have this definition for the rest of the proxied sites however.

<Proxy *>
  Order deny,allow
  Allow from all
</Proxy>

No matter what i do it seems to be accessible from any where. Is this because of the definition for all other proxied sites. Is there an order to which it applies Proxy directives. I have had the newsite one both before and after the * one, and also within the VirtualHost statement.

share|improve this question

3 Answers 3

had a similar problem today; Was related to how the wildcard matching is done, I think it uses the full URL: in my case I had

<Proxy /jira*>
  Order allow,deny
  Deny from all
</Proxy>
ProxyPass /jira https://myhost.com

and this did not work. Site was accessible from anywhere. I tried a couple of things and found a working version:

<Proxy *jira*>

So in your case try with

<Proxy http://newsite.com*>

to make sure apache matches that url.

share|improve this answer
<VirtualHost *:80>
    Servername newsite.com

    <Proxy *>
            Order Deny,Allow
            Deny from all
            Allow from x.x.x.x
    </Proxy>

    ProxyPass /  http://newsite.com/
    ProxyPassReverse /  http://newsite.com/

</VirtualHost>
share|improve this answer
1  
What does this do, and why does it to it? –  sysadmin1138 Nov 26 '14 at 17:29
    
That's a reverse proxy that's only accessible by a certain IP (to be defined by substituting the 'x' in Allow from x.x.x.x). –  dr0i Feb 23 at 9:43

You are using ServerName and ServerAlias for matching newsite.com.

You should NOT use for a reverse proxy configuration the directive:

<Proxy whatever>

You should use:

For apache 2.2:

<Location />
Order Deny,Allow
Deny from all
Allow from x.x.x.x
</Location>

For apache 2.4:

<Location />
   <RequireAny>
       Require             ip x.x.x.x/255.255.255.0
       Require ...
</Location>

After doing the Authz, you simply should do a ProxyPass, and the ProxyPassReverse (for the 302,301 redirects):

ProxyPass /  http://newsite.com/
ProxyPassReverse /  http://newsite.com/

Take in mind that with this you need to add newsite.com to your /etc/hosts or that dns should resolve the host in the url. You may also use IP address only but you should instruct the httpd server that Preserves the "Host:" header with:

ProxyPreserveHost On
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.