Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an endpoint that we've locked down to be only accessible from specific IPs. We have a conf section kinda like this:

<Location /Foo>
    Order allow,deny
    Allow from 
    Allow from 111.222.333.444

Now, it's gotten to the point where we need to load balance it between a couple of machines, but we still need to lock it down to only be accessible from those IPs.

So... how can I set Apache to Allow from the X-Forwarded-For?

share|improve this question
Can't the load balancer do the security instead of Apache? – David Jun 27 '12 at 22:38
Do you need to use the normal IP authorization directives for some specific reason, or can you use another method? – Shane Madden Jun 28 '12 at 0:14

Presumably you have a load balancer that is doing SNAT/NAPT obscuring the client IP address.

Have you seen this answer, which solves it using SetEnvIf? Apache, use X-Forwarded-For for allow

There's a comment on that answer about forging. I'd point out that:

  • Someone who can reach your server directly (presumably an internal attacker) can fake the X-Forwarded-For header, so you should also lock Apache down to just the load balancer SNAT address(es).
  • Your load balancer should be scrubbing X-Forwarded-For headers from incoming requests so that external attackers can't fake it.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.