With the following snippet, everyone can access both /foo and /bar

ProxyPass /foo http://example.com/foo
ProxyPassReverse /foo http://example.com/foo 
ProxyPass /bar http://example.com/bar
ProxyPassReverse /bar http://example.com/bar

But what if I want /foo to be accessible for everyone, and /bar only for requests coming from a specific IP, is this possible?


I think you can use a SetEnvIf directive checking the Remote Address (Remote_Addr).

With one IP:

SetEnvIf Remote_Addr "" TRUST=yes

Checking multiple IPs with regular expression

SetEnvIf Remote_Addr "123\.123\.123\.123|134\.134\.(134\.(134|134)|134\.134)" TRUST=yes

I'm not sure you can do directly this:

ProxyPass /foo http://example.com/foo env=TRUST

But probably you can work with Rewrite Rules and obtain the same result...

For example you can rewrite to a particular page all the IP that are not trusted (env=!TRUST)

Hope it helps.

  • Passing env=TRUST gives a syntax error, but your second suggestion put me in the right direction. Adding a rewriterule BEFORE any proxy definitions in httpd.conf worked. See detailed instructions on this site: the-art-of-web.com/system/rewrite/#section_1
    – mobmad
    Feb 15 '10 at 12:49

The answer should be as follows. I have included an IP and a subnet in one rule, for those who need to allow a whole subnet rather than a set of single IPs.

<Location /foo>
    Deny from all                       // **This rule is the most IMPORTANT**    
    Allow from 10.100       // The second value implies subnet
    ProxyPass http://example.com/foo
    ProxyPassReverse http://example.com/foo
<Location /bar>
    Allow from ...
    ProxyPass http://example.com/bar
    ProxyPassReverse http://example.com/bar

Note the first argument to ProxyPass and ProxyPassReverse is implied here to be the target of the location block.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.