![无法配置 apache 以限制代理 IP 访问](https://linux22.com/image/619423/%E6%97%A0%E6%B3%95%E9%85%8D%E7%BD%AE%20apache%20%E4%BB%A5%E9%99%90%E5%88%B6%E4%BB%A3%E7%90%86%20IP%20%E8%AE%BF%E9%97%AE.png)
我在 httpd.conf 中添加了以下内容(在 VirtualHost 之后):
<VirtualHost *:80>
ServerName XXX.XXX.XXX
<Directory proxy:>
Order allow,deny
Allow from 10.52.208.221
Allow from 10.52.208.223
Deny from all
</Directory>
ProxyPass / http://XXX.XXX.XXX/
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/admin/$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>
但是,我可以从其他 IP 访问我的 VirtualHost:
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.4 (Santiago)
# uname -a
Linux XXXXX.XXXXX.XXX 2.6.32-358.18.1.el6.x86_64 #1 SMP Fri Aug 2 17:04:38 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
# httpd -V
Server version: Apache/2.2.15 (Unix)
Server built: Aug 2 2013 08:02:15
Server's Module Magic Number: 20051115:25
Server loaded: APR 1.3.9, APR-Util 1.3.9
Compiled using: APR 1.3.9, APR-Util 1.3.9
Architecture: 64-bit
Server MPM: Prefork
threaded: no
forked: yes (variable process count)
Server compiled with....
-D APACHE_MPM_DIR="server/mpm/prefork"
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=128
-D HTTPD_ROOT="/etc/httpd"
-D SUEXEC_BIN="/usr/sbin/suexec"
-D DEFAULT_PIDLOG="run/httpd.pid"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_LOCKFILE="logs/accept.lock"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="conf/mime.types"
-D SERVER_CONFIG_FILE="conf/httpd.conf"
# rpm -q httpd
httpd-2.2.15-29.el6_4.x86_64
#
答案1
我找到了以下答案:mod_proxy——Apache HTTP 服务器然后我测试了它(它有效!(TM)):
<Proxy *>
Order deny,allow
Deny from all
Allow from 10.52.208.221
Allow from 10.52.208.223
</Proxy>
答案2
我相信您正在寻找的是:
<Directory proxy:>
Order deny,allow
Deny from all
Allow from 10.52.208.221
Allow from 10.52.208.223
</Directory>
顺序很重要:-)
答案3
如果您想限制代理网站的某些路径,以下配置可能会派上用场。
对于那些需要允许整个子网而不是一组单个 IP 的用户,我在一条规则中包含了一个 IP 和一个子网。
<Location /foo>
Deny from all // **This rule is the most IMPORTANT**
Allow from 192.168.1.2 10.100 // The second value implies 10.100.0.0/16 subnet
ProxyPass http://example.com/foo
ProxyPassReverse http://example.com/foo
</Location>