How to restricted IP to access my web server that behind a AWS LB

Question

Hello,
I have an Apache webserver behind a **AWS Application LB**. As it is only a staging server so would like to have the restricted access as:

1.  **Only some IP addresses are allowed. ** 
2. **Username/password in a httpassword file **

If visitors' IPs are out of the IP range (1), username and password will be required.

I already defined these restrictions in Apache config for my server. However, it seems that the config for **IP address allowed** does not work as I still have to enter username/password even I access from an allowed IP address (and also have the header of **X-Forwarded-For** in the request)

Note: I already follow the instruction https://docs.aws.amazon.com/elasticloadbalancing/latest/application/x-forwarded-headers.html. For **X-Forwarded-For header** radio button, I already selected **Append**  or **Preserve**, both ways did not work

Many thanks

Riku_Kobayashi · Accepted Answer

Hello.

By configuring the settings as shown below, a specific global IP address can pass basic authentication.  
Please enter the IP address in the "aaa" part without changing the escaped part.  
For example, if you want to allow the IP address "1.1.1.1", set "SetEnvIf X-Forwarded-For "1\.1\.1\.1.*" allowed_ip".  
```
SetEnvIf User-Agent "^ELB-HealthChecker.*$" healthcheck
SetEnvIf X-Forwarded-For "1\.1\.1\.1.*" allowed_ip
SetEnvIf X-Forwarded-For "aaa\.aaa\.aaa\.aaa.*" allowed_ip
SetEnvIf X-Forwarded-For "bbb\.bbb\.bbb\.bbb.*" allowed_ip

AuthUserFile /etc/httpd/htpasswd
    AuthName "Please enter your ID and password"
    AuthType Basic

Require env healthcheck allowed_ip
    Require valid-user

Require all denied

```

son · Answer

It works correctly with Riku_Kobayashi's answer

How to restricted IP to access my web server that behind a AWS LB

Relevant content