Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server that hosts Tomcat for apps and Apache2 for it's frontend. They communicate to each other through ajp protocol over mod_moxy and proxy_ajp modules.

Am I really safe using apache virtualhosts in this form:

        ProxyRequests Off

        <Proxy *>
                Order deny,allow
                Deny from all
                Allow from

        ProxyPass / ajp://srv.local:8009/
        ProxyPassReverse / http://srv.local

0.100 is the server's IP address and behind port 8009 is the Tomcat AJP connector. I want Apache to cut any proxy requests from outside and allow only itself to use it for communicating with Tomcat.

share|improve this question
Can you clarify what you're trying to accomplish? That configuration will block all access through Apache to the Tomcat service, except for - is that what you're going for? Or are you trying to make sure that any communication with Tomcat happens via the Apache service? – Shane Madden Jan 5 '13 at 8:25
I want to serve Tomcat application(s) to WWW through Apache. Tomcat is backend and therefore unacessible directly. Since Apache and Tomcat are paired through proxy_ajp, I want to make sure that nothing from WWW can abuse my proxy. So my question would be, is this correct to block all access to proxy except the server itself? This setting is currently on our dev server and we can access Tomcat webapps. – user1492810 Jan 5 '13 at 9:03

The access controls in a <Proxy> block apply to where the request comes from, rather than where a request is going. As long as ProxyRequests is disabled, requests through the proxy will never be sent to a destination that you didn't configure.

So, your <Proxy *> block can be removed with no risk.

share|improve this answer
Thanks. We're good now. – user1492810 Jan 13 '13 at 12:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.