Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an apache proxy server that forwards requests to backend servers. The backend servers use mod_access to allow or deny access to specific directories. Before implementing a proxy server with backend web servers, the one web server used a syntax like:

order deny, allow deny from all allow from 10.10.4 allow from

but now, the ip and domain are always the proxy server. I know the X-Forwarded_For ip is set, but I don't know how to add that into the mod_access configuration. And I don't see the forwarded host at all. Is there any way to do this?

share|improve this question
up vote 1 down vote accepted

This is untested but should work:

Backend config:

SetEnvIf X-Forwarded-For "^192\.168\.0\." allowme
order allow,deny
allow from env=allowme
deny from all

This would allow from and block all others..

share|improve this answer
Is there any way to add pass the domain name of the requesting client and allow based on that? – dan Jun 17 '09 at 21:19
The hostname for the requesting ip? Sorry, that is not part of the http-request and is almost impossible to know, the reverse record for the requesting ip, maybe but I'm not sure how to use it... – rkthkr Jun 18 '09 at 5:24
Found the answer on another site. you have to make sure HostnameLookups is turned on on the load balancer and add the lines: SetEnvIf Remote_Host "(.*)" remote=$1 RequestHeader set x-rem-host %{remote}e to the configuration file. then "x-rem-host" is available on the individual web servers. thanks for your help! – dan Jun 18 '09 at 15:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.