Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an Apache server that works as a proxy for apps running on different ports. For example:  >  localhost:101  >  localhost:102  >  localhost:201

Rules to determine application port are rather complex so I use a script to do that using mod_rewrite:

RewriteEngine On
RewriteMap mapper prg:/foler/
RewriteRule ^(.*)$ ${mapper:%{REQUEST_URI}} [P]

The problem I'm having is that looking at the logs, there are a lot of request from bots getting content from other web sites. I tested if I could proxy content from other servers and I could:

telnet 80

Here I get content from Yahoo, which means that anyone can connect to my server and start making requests to other servers.

I've seen that Apache recommends to secure your proxy as stated here:

But the problem is that I don't know what IPs will use my server in advanced, so my question is how to solve this issue while at the same time anyone can make request to my apps?

Some additional information:

  • All my apps are in the same machine as my Apache server
  • If I need to move my apps to different servers, they are going to still be on my Intrantet
  • I have mod_proxy, mod_proxy_http and mod_rewrite enabled


share|improve this question

If I understand correctly what you are doing, you don't need a forward proxy, but a gateway, because all you are proxying are requests from the WAN to the intranet, i.e. a reverse proxy, why don't just disable ProxyRequest?

ProxyRequest Off

ProxyRequests Directive

This allows or prevents Apache httpd from functioning as a forward proxy server. (Setting ProxyRequests to Off does not disable use of the ProxyPass directive.)

In a typical reverse proxy or gateway configuration, this option should be set to Off.

share|improve this answer
Yes, that's disabled, but still proxies everything. What I've done so far to prevent proxing any request is to add a new RewriteCond so it only proxies URLs from my domain, but not sure if that's the best way to do it. – dgaviola Jul 31 '13 at 12:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.