Apache X-Forwarded-For

When configuring Apache X-Forwarded-For take in consideration the differences for Apache versions 2.2 and 2.4.

Example to allow specific IP addresses (Apache 2.4):

<Location "/restricted-path">
    SetEnvIF X-Forwarded-For "1.1.1.1" AllowIP
    SetEnvIF X-Forwarded-For ^10\. AllowIP

    <RequireAny>
        Require env AllowIP
    </RequireAny>
</Location>

References:

• Apache Module mod_remoteip
• Apache logs
• Apache Module mod_log_config
• How do I capture client IP addresses in my ELB access logs?
• HOWTO: Log Client IP AND X-Forwarded-For IP in Apache
• Block / Allow IP with Apache 2

Full article