I have set up a virtual host (sub.domain.com) on my local network server that is accessible from inside and from outside via port forwarding in my router. I would like to add an additional directory sub.domain.com/only_local that can not be accessed from outside.

Using (Apache version 2.4.10 on a debian machine)

<Directory /var/www/only_local>                                               
    AllowOverride None                                                      
    Require host localhost                                                  
    Require ip                                                    
    Require ip 192.168.1

allows me to restrict external access. In this case, however, I can connect to the page only using the local address Trying to open sub.domain.com/only_local (from the local network!) yields 403 Forbidden, which is inconvenient, as domain names are much more catchy than ip addresses and my TLS certificates are valid for sub.domain.com only.

As far as I understood this post this restriction is intended, as the server receives a connection request that seems to come from the external network due to address translation.

So what do I have to do, in order to obtain an exclusively locally accessible webpage that can be loaded using a domain name?

  • Instead of requiring a single IP, require an CIDR style network/netmask - ie,
    – ivanivan
    Commented Apr 4, 2018 at 16:02
  • I tried as well as, but the result is the same.
    – staxyz
    Commented Apr 4, 2018 at 16:12

1 Answer 1


Is the IP address in the DNS for sub.domain.com local or external? When attempting to access that address via the subdomain, what does the server think your IP address is?

If sub.domain.com points to an external IP address, you are no longer accessing it from 192.168.1, but from your internet IP address assigned to you by your ISP so you can access the internet. Try adding that IP to the configuration and see if it works any better.

The local and external networks are separate, the local network cannot communicate with the external network without some bridge or router. Once through the bridge/router, you are no longer on the internal network but the external network.

Another option would be to add a DNS "A" record for sub.domain.com to also point to your local IP address. That may require some extra config to get working properly, but should be possible.

  • The server thinks the IP address is exeternal. I prefer to not mess around with the DNS records, as I am very unexperienced in this field. Adding my external IP to the "Require"-list worked indeed, so I could probably create some cronjob that adjusts the apache config after every IP change. However this seems like a bad hack and I have the feeling, that my issue is a rather common problem. Is there no simpler solution?
    – staxyz
    Commented Apr 4, 2018 at 20:10
  • The standard thing to do is you would have an external DNS server serving the external DNS, then you would also have an internal DNS server for serving your internal/local DNS. To keep your setup, it would probably be beneficial to look into dynamic DNS which is designed to have a domain name that adjusts to your non-static ISP provided address, then you would add that domain to your allow list instead of your IP address. Commented Apr 5, 2018 at 7:07
  • I already use an external DNS for my local server. Now that you mention it, it is kind of obvious to use "Require host sub.domain.com". However, there is a subtlety: Apache performs reverse DNS lookup of the source IP and only permits access, if the retrieved record matches the domain in the "Require host"-field. As this source IP is managed by the ISP I don't see any option to create an appropriate PTR. Luckily, there is a "Require forward-DNS"-option, which performs a forward lookup only. It is available for versions >= 2.4.19. Please add these information to your answer and I'll accept it.
    – staxyz
    Commented Apr 5, 2018 at 9:36
  • No, that is not what I said. I said you should have an internal dns server that serves domains with internal IP addresses. Mixing external and internal IP addresses is not how this is supposed to work, but there are hacks and workarounds. Your initial question was to restrict contact to only the local network, that will not be possible if you wish to use the external addresses and instead you must add the external IP address you are connecting from to your allow list. Commented Apr 5, 2018 at 10:02
  • Well, my bad. I had my setup in mind, where all local devices have the same IP address, that is the one associated with sub.domain.com; so it works in this case. But I think what you wanted to say is, that I need an internal DNS server for a general solution, if Apache and client do not have the same external IP address, right?
    – staxyz
    Commented Apr 5, 2018 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .