Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an endpoint that we've locked down to be only accessible from specific IPs. We have a conf section kinda like this:

<Location /Foo>
    Order allow,deny
    Allow from 111.111.111.111 
    Allow from 111.222.333.444
    ...
</Location>

Now, it's gotten to the point where we need to load balance it between a couple of machines, but we still need to lock it down to only be accessible from those IPs.

So... how can I set Apache to Allow from the X-Forwarded-For?

share|improve this question
    
Can't the load balancer do the security instead of Apache? –  Dave Jun 27 '12 at 22:38
    
Do you need to use the normal IP authorization directives for some specific reason, or can you use another method? –  Shane Madden Jun 28 '12 at 0:14
add comment

1 Answer

Presumably you have a load balancer that is doing SNAT/NAPT obscuring the client IP address.

Have you seen this answer, which solves it using SetEnvIf? Apache, use X-Forwarded-For for allow

There's a comment on that answer about forging. I'd point out that:

  • Someone who can reach your server directly (presumably an internal attacker) can fake the X-Forwarded-For header, so you should also lock Apache down to just the load balancer SNAT address(es).
  • Your load balancer should be scrubbing X-Forwarded-For headers from incoming requests so that external attackers can't fake it.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.