Apache · Configuration and operations
How do you restrict access by IP, host or network in Apache?
Short answer
Use Require ip, Require host or Require expr to allow or deny requests by origin. Network restrictions are defense in depth, not a substitute for authentication, and they must account for proxies and IPv6.
Access control decides whether a request may proceed based on attributes such as the client address or hostname. In Apache 2.4 it is expressed with Require. The older Order, Allow and Deny directives still work through mod_access_compat but should be migrated.
<Location "/internal">
<RequireAll>
Require ip 10.0.0.0/8 192.168.0.0/16
Require not ip 10.9.9.9
</RequireAll>
</Location>
<Location "/metrics">
Require host monitoring.example.com
</Location>
<Directory "/var/www/app">
Options -Indexes
Require all granted
</Directory>Pitfalls
- Behind a proxy, the connection address may be the proxy's, not the client's
- X-Forwarded-For is client-controlled unless a trusted proxy overwrites it
- IPv6 addresses need their own rules; an IPv4 CIDR does not cover them
- Hostname-based rules trigger reverse DNS, which is slow and spoofable without forward confirmation
- Allowlisting by IP breaks when clients use mobile networks or cloud egress ranges
For administrative endpoints, combine network restriction with authentication and TLS. For public APIs, prefer authentication and rate limiting over IP allowlists. If you must trust a forwarded address, use mod_remoteip with an explicit trusted proxy list rather than reading X-Forwarded-For directly.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1How do you restrict an endpoint to an internal network?
- 2What changes when Apache sits behind a load balancer?
- 3Why is hostname-based access control risky?
- 4How does mod_remoteip help?
Say it in the interview
I use Require ip or Require host for network restrictions, often combined with authentication for admin paths. The main gotcha is proxying: the apparent client address may be the load balancer. I handle that with mod_remoteip and a trusted proxy list, never by trusting X-Forwarded-For directly. I also remember IPv6 needs explicit rules.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.