8

I have an Apache reverse proxy that is currently reverse proxying for a few sites. However i am now going to be adding a new site (lets call it newsite.com) that should only be accessible by certain IP's. Is this doable using Apache as a reverse proxy?

I use VirtualHosts for the sites that are being proxyied. I have tried using the Allow/Deny directives in combination with the Location statements. For example:

<VirtualHost *:80>  
Servername newsite.com   
<Location http://newsite.com>
Order Deny,Allow
Deny from all
Allow from x.x.x.x
</Location>
<IfModule rewrite_module>
 RewriteRule ^/$ http://newsite.internal.com [proxy]
</IfModule>

I have also tried configuring allow/deny specicaily for the site in the Proxy directives, for example

<Proxy http://newsite.com/>
  Order deny,allow
  Deny from all
  Allow from x.x.x.x
</Proxy>

I still have this definition for the rest of the proxied sites however.

<Proxy *>
  Order deny,allow
  Allow from all
</Proxy>

No matter what i do it seems to be accessible from any where. Is this because of the definition for all other proxied sites. Is there an order to which it applies Proxy directives. I have had the newsite one both before and after the * one, and also within the VirtualHost statement.

2

You are using ServerName and ServerAlias for matching newsite.com.

You should NOT use for a reverse proxy configuration the directive:

<Proxy whatever>

You should use:

For apache 2.2:

<Location />
Order Deny,Allow
Deny from all
Allow from x.x.x.x
</Location>

For apache 2.4:

<Location />
   <RequireAny>
       Require             ip x.x.x.x/255.255.255.0
       Require ...
</Location>

After doing the Authz, you simply should do a ProxyPass, and the ProxyPassReverse (for the 302,301 redirects):

ProxyPass /  http://newsite.com/
ProxyPassReverse /  http://newsite.com/

Take in mind that with this you need to add newsite.com to your /etc/hosts or that dns should resolve the host in the url. You may also use IP address only but you should instruct the httpd server that Preserves the "Host:" header with:

ProxyPreserveHost On
0

had a similar problem today; Was related to how the wildcard matching is done, I think it uses the full URL: in my case I had

<Proxy /jira*>
  Order allow,deny
  Deny from all
</Proxy>
ProxyPass /jira https://myhost.com

and this did not work. Site was accessible from anywhere. I tried a couple of things and found a working version:

<Proxy *jira*>

So in your case try with

<Proxy http://newsite.com*>

to make sure apache matches that url.

0
<VirtualHost *:80>
    Servername newsite.com

    <Proxy *>
            Order Deny,Allow
            Deny from all
            Allow from x.x.x.x
    </Proxy>

    ProxyPass /  http://newsite.com/
    ProxyPassReverse /  http://newsite.com/

</VirtualHost>
  • 1
    What does this do, and why does it to it? – sysadmin1138 Nov 26 '14 at 17:29
  • That's a reverse proxy that's only accessible by a certain IP (to be defined by substituting the 'x' in Allow from x.x.x.x). – dr0i Feb 23 '15 at 9:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.