12

How can use X-Forwarded-For headers(my proxy ip 10.1.1.x) to allow HTTP query?

22

You can use SetEnvIf and Allow:

    <Location "/only_proxy/">
            SetEnvIf X-Forwarded-For ^10\.1\.1\. proxy_env
            Order allow,deny
            Satisfy Any
            Allow from env=proxy_env
    </Location>
  • 1
    Remember that it's really easy to forge X-Forwarded-For header. – Olli Feb 15 '11 at 12:52
  • It's also reasonably easy to protect yourself from forged X-Forwarded-For headers (by stripping this header at entry points into your environment). – larsks Oct 2 '12 at 1:52
  • 1
    found this post while looking for information on how to protect against forged x-forwarded headers, would you mind pointing to a relevant doc? – Pete Nov 1 '12 at 17:12
2

You can use mod_rpaf to make Apache treat the X-Forwarded-For IP as the client IP.

  • 7
    For those who find their way here from Google: note that mod_rpaf is only able to make your logs useful; it does not actually affect the address used in access control decisions. Also note that in Apache 2.4, the mod_rpaf functionality is provided natively by mod_remoteip. – larsks Oct 2 '12 at 1:50
  • 1
    @larsks: That is not true. I tried and it did work for me! – confiq Aug 25 '14 at 12:48
2

You can write a rewrite rule to redirect to 403 response.

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-For} !(1.1.1.1|2.2.2.2)
RewriteRule .* - [F]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.