2

We have an endpoint that we've locked down to be only accessible from specific IPs. We have a conf section kinda like this:

<Location /Foo>
    Order allow,deny
    Allow from 111.111.111.111 
    Allow from 111.222.333.444
    ...
</Location>

Now, it's gotten to the point where we need to load balance it between a couple of machines, but we still need to lock it down to only be accessible from those IPs.

So... how can I set Apache to Allow from the X-Forwarded-For?

2
  • Can't the load balancer do the security instead of Apache?
    – David
    Jun 27, 2012 at 22:38
  • Do you need to use the normal IP authorization directives for some specific reason, or can you use another method? Jun 28, 2012 at 0:14

1 Answer 1

1

Presumably you have a load balancer that is doing SNAT/NAPT obscuring the client IP address.

Have you seen this answer, which solves it using SetEnvIf? Apache, use X-Forwarded-For for allow

There's a comment on that answer about forging. I'd point out that:

  • Someone who can reach your server directly (presumably an internal attacker) can fake the X-Forwarded-For header, so you should also lock Apache down to just the load balancer SNAT address(es).
  • Your load balancer should be scrubbing X-Forwarded-For headers from incoming requests so that external attackers can't fake it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .