With the following snippet, everyone can access both /foo and /bar

ProxyPass /foo http://example.com/foo
ProxyPassReverse /foo http://example.com/foo 
ProxyPass /bar http://example.com/bar
ProxyPassReverse /bar http://example.com/bar

But what if I want /foo to be accessible for everyone, and /bar only for requests coming from a specific IP, is this possible?

3 Answers 3


I think you can use a SetEnvIf directive checking the Remote Address (Remote_Addr).

With one IP:

SetEnvIf Remote_Addr "" TRUST=yes

Checking multiple IPs with regular expression

SetEnvIf Remote_Addr "123\.123\.123\.123|134\.134\.(134\.(134|134)|134\.134)" TRUST=yes

I'm not sure you can do directly this:

ProxyPass /foo http://example.com/foo env=TRUST

But probably you can work with Rewrite Rules and obtain the same result...

For example you can rewrite to a particular page all the IP that are not trusted (env=!TRUST)

Hope it helps.

  • Passing env=TRUST gives a syntax error, but your second suggestion put me in the right direction. Adding a rewriterule BEFORE any proxy definitions in httpd.conf worked. See detailed instructions on this site: the-art-of-web.com/system/rewrite/#section_1
    – mobmad
    Commented Feb 15, 2010 at 12:49

The answer should be as follows. I have included an IP and a subnet in one rule, for those who need to allow a whole subnet rather than a set of single IPs.

<Location /foo>
    Deny from all                       // **This rule is the most IMPORTANT**    
    Allow from 10.100       // The second value implies subnet
    ProxyPass http://example.com/foo
    ProxyPassReverse http://example.com/foo
<Location /bar>
    Allow from ...
    ProxyPass http://example.com/bar
    ProxyPassReverse http://example.com/bar

Note the first argument to ProxyPass and ProxyPassReverse is implied here to be the target of the location block.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .