Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site running on Nginx (v1.0.14) serving as reverse proxy which proxies requests to Apache (v2.2.19). So Nginx runs on port 80, Apache is on 8080.

Overall site works fine except that i cannot block access to certain directories with .htaccess file.

For example i have 'my-protected-directory' on '' Inside it i have htaccess with following code:

<Files *>
order deny,allow
deny from all
allow from <--- my ip address here

When i try to access this page with my ip ( i get 404 error which is not what i expect:

However everything works as expected when this page is served directly by Apache. I can see this page, everyone else can't.

Update. Nginx config ( is site ip.):

user  apache;
worker_processes  4;
error_log  logs/error.log;
pid        logs/;

events {
    worker_connections  1024;

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    sendfile        on;
    keepalive_timeout  65;
    gzip  on;
    gzip_min_length 1024;
    gzip_http_version 1.1;
    gzip_proxied any;
    gzip_comp_level 5;
    gzip_types    text/plain text/css
                  application/x-javascript text/xml
                  application/xml application/xml+rss
                  text/javascript image/x-icon;

    server {
    listen       80;
    access_log  logs/host.access.log  main;

    # serve static files
    location ~* ^.+.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|js)$ {
      root    /var/www/vhosts/;
      proxy_set_header Range "";
      expires 30d;

    # pass requests for dynamic content to Apache
    location / {
      proxy_redirect               off;
      proxy_set_header X-Real-IP  $remote_addr;
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Range "";

Update 2: mod_rpaf is installed and ip address get determined correctly

Could please anyone tell me what is wrong and how this can be fixed ?

share|improve this question
Can you post the relevant section of your nginx config? – Kyle Mar 25 '12 at 22:45
...and the Apache config, as well. Are you expecting the .htaccess file to be obeyed when nginx is serving the content? – Shane Madden Mar 25 '12 at 22:47
2 Shane Madden - Actually i am accessing php file inside 'protected' directory. Nginx only serves static content and Apache serves dynamic. So in this config Apache should obey htaccess rules but it does that only when file is served directly from Apache (, not proxied throught Nginx ( – Termos Mar 25 '12 at 23:37

If nginx is proxying to apache, then the connection to apache is coming from nginx, not coming from you, and thus your IP never enters the equation.

You can set an environment variable based on your original IP (which will be stored in the x-forwarded-for header), and then allow requests with that variable set:

<Location "/">
    SetEnvIf X-Forwarded-For ^1\.2\.3\.4 proxy_env
    Order allow,deny
    Satisfy Any
    Allow from env=proxy_env
share|improve this answer
You are not right. Apache mod_rpaf is installed so Apache sees user ip. I rechecked this and 1) deleted htaccess file 2) put php file which shows user ip (echo getenv('REMOTE_ADDR')). I see my ip when i delete htaccess file. When i enable it i get "Client denied by server configuration error" in logs. – Termos Mar 26 '12 at 9:06
What Shish recommends is a much more generic way that does not rely on any modules. I'd much prefer this. – Stefan Förster Sep 13 '13 at 10:35
up vote 1 down vote accepted

I have managed to resolve this issue. The problem was in Rpaf module which under some condition works incorrectly. By 'conditions' i mean Apache version and OS. (Mine was Apache 2.2 on CentOS)

Anyway, to fix this you should disable rpaf module and install it's patched version from here: mod_realip2

Installation is clear and simple. Hope this helps someone because i have spent hours and hours looking for resolution.

share|improve this answer

You can try to add into nginx' server section error_log <path> debug;, run the request and see how is it parsed against location rules. Sometime it is not that obvious...

share|improve this answer

You placed the root directive under location instead of server. This is one of the most common nginx misconfigurations. And in this case it will be directly responsible for your 404 error.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.