We have an endpoint that we've locked down to be only accessible from specific IPs. We have a conf section kinda like this:

<Location /Foo>
    Order allow,deny
    Allow from 
    Allow from 111.222.333.444

Now, it's gotten to the point where we need to load balance it between a couple of machines, but we still need to lock it down to only be accessible from those IPs.

So... how can I set Apache to Allow from the X-Forwarded-For?

  • Can't the load balancer do the security instead of Apache? – David Jun 27 '12 at 22:38
  • Do you need to use the normal IP authorization directives for some specific reason, or can you use another method? – Shane Madden Jun 28 '12 at 0:14

Presumably you have a load balancer that is doing SNAT/NAPT obscuring the client IP address.

Have you seen this answer, which solves it using SetEnvIf? Apache, use X-Forwarded-For for allow

There's a comment on that answer about forging. I'd point out that:

  • Someone who can reach your server directly (presumably an internal attacker) can fake the X-Forwarded-For header, so you should also lock Apache down to just the load balancer SNAT address(es).
  • Your load balancer should be scrubbing X-Forwarded-For headers from incoming requests so that external attackers can't fake it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.