I have multiple application servers running as EC2 instances. Only certain bare-metal servers running elsewhere are allowed to contact them and their IPs whitelisted explicitly in the httpd.conf @the application servers.
I want to move the application servers behind ELB for load balancing purposes, now I've read about the X-Forwarded-For header which will be forwarded to the application server from ELB and based on that one can allow certain IPs. My question is how do I set this up?
Currently my apache config on application server looks like this:
<VirtualHost *:80>
ServerAdmin abc@foo.com
ServerName bar.foo.in
DocumentRoot /home/foo/bar
<Directory /home/foo/bar>
Options Indexes Multiviews FollowSymLinks
AllowOverride All
Order Deny,Allow
Deny from all
Allow from X.X.X.X Y.Y.Y.Y Z.Z.Z.Z A.A.A.A
</Directory>
I'm thinking about using SetEnvIf directive to allow IPs based on X-Forwarded-For value but I'm not sure about this. I have the following changes in mind. Can someone verify this before I put this into production?
<VirtualHost *:80>
...................
....................
<Directory /home/foo/bar>
SetEnvIF X-Forwarded-For "X.X.X.X|Y.Y.Y.Y|A.A.A.A" AllowIP
Options Indexes Multiviews FollowSymLinks
AllowOverride All
Order Deny,Allow
Deny from all
Allow from env=AllowIP
</Directory>
Thanks