Configure Apache as a Forward Proxy

Learn to configure Apache on Debian or Ubuntu as a restricted HTTP and HTTPS forward proxy using mod_proxy, access controls, logging, and validation tests.

A forward proxy is an intermediary that makes outbound requests to origin servers for configured clients. The client connects to Apache, Apache connects to the external origin server, and Apache returns the response to the client.

With a direct connection, the flow is client → origin server. With a forward proxy, the flow is client → Apache forward proxy → origin server. A device or application must be explicitly configured with the proxy hostname or IP address and port; merely running Apache does not make clients use it.

Forward proxy versus reverse proxy

Characteristic	Forward proxy	Reverse proxy
Primary user	Client devices and applications	Backend applications or origin servers
Request direction	Clients send outbound requests through the proxy	Clients send requests to the proxy, which selects a backend
Client configuration requirement	Clients must be configured to use the proxy	Clients normally connect to the reverse proxy as the service endpoint
Typical use case	Controlled access to external HTTP and HTTPS destinations	Load balancing, TLS termination, or publishing internal applications
Security exposure	Must be restricted to trusted clients to avoid becoming an open proxy	Must protect published backend services and administrative interfaces

Security considerations

An unrestricted forward proxy can become an open proxy: a proxy accessible to untrusted users without adequate restrictions. Attackers may use it to hide their source addresses, consume bandwidth, reach destinations through your network, or abuse your server.

Permit proxy use only from trusted internal IP ranges or explicitly approved clients.
Expose the proxy listener only to intended networks with host-firewall and network-firewall rules.
Use authentication when source-IP restrictions are insufficient, such as when clients are mobile, share a broad network, or cannot be reliably identified by address.
Enable forward-proxy operation only where it is intentionally needed.
After configuration, test from an unauthorized network to confirm that access is denied.

The example authorization rule uses Require ip 192.168. In Apache 2.4, this represents the private network 192.168.0.0/16, covering addresses from 192.168.0.0 through 192.168.255.255. Do not use this rule unless that entire range is trusted in your environment.

Required Apache modules

Apache's proxy framework is provided by mod_proxy. Protocol-specific modules extend it for ordinary HTTP requests and HTTPS tunnels. Module names and enablement commands vary by distribution; the following commands apply to Debian and Ubuntu.

Module	Purpose	Traffic or feature supported
`proxy`	Provides core proxy capabilities	Proxy framework and common proxy processing
`proxy_http`	Handles HTTP proxy protocol support	HTTP requests sent through the forward proxy
`proxy_connect`	Supports the CONNECT method	TCP tunnels, commonly used for HTTPS destinations

sudo a2enmod proxy proxy_http proxy_connect

The CONNECT method asks a proxy to create a TCP tunnel to a destination such as an HTTPS server. After the tunnel is established, TLS negotiation occurs between the client and the destination through that tunnel.

Plan the Apache configuration

This example uses a dedicated virtual host on port 8080. A VirtualHost is an Apache configuration block that defines behavior for a particular address and port. The Listen directive opens a port for incoming connections.

Keeping the proxy in a dedicated virtual host makes its listener, authorization policy, and logs easier to identify. Settings such as ProxyRequests On can also be placed in broader Apache configuration scope, but global settings affect more requests and are easier to enable accidentally. Prefer a narrowly scoped dedicated configuration when the proxy has a specific purpose.

Create the forward-proxy virtual host

Create /etc/apache2/sites-available/forward_proxy.conf:

<VirtualHost *:8080>
    ProxyRequests On
    ProxyVia On

    <Proxy "*">
        Require ip 192.168
    </Proxy>

    ErrorLog ${APACHE_LOG_DIR}/error_forward_proxy.log
    CustomLog ${APACHE_LOG_DIR}/access_forward_proxy.log combined
</VirtualHost>

ProxyRequests On enables forward-proxy request handling. It must not be enabled without an appropriate access policy.

ProxyVia On makes Apache add proxy-related Via headers. These headers help identify proxy hops in HTTP traffic and can improve operational visibility.

The <Proxy "*"> container applies authorization rules to proxy request targets. Require ip 192.168 allows clients whose source address belongs to the specified private range. It is an authorization rule for clients using the proxy, not a rule that permits Apache to access only that destination range.

Open the proxy listener

Add the following line to /etc/apache2/ports.conf:

Listen 8080

The port in Listen 8080 must agree with <VirtualHost *:8080>. If the ports differ, Apache may listen on one port while the virtual host is configured for another.

Enable the site and apply the configuration

sudo a2ensite forward_proxy.conf
sudo apache2ctl configtest
sudo systemctl restart apache2

Run the syntax check before restarting. A successful check normally reports Syntax OK. Restart Apache after enabling modules, changing the listener, or enabling the site. A reload can be used for configuration-only changes when appropriate, but a restart is straightforward for this initial setup.

Directive reference

Directive or block	Example value	Effect	Security consideration
`VirtualHost`	`*:8080`	Defines proxy behavior for port 8080	Use a dedicated listener and limit its network exposure
`Listen`	`8080`	Opens port 8080 for incoming connections	Allow the port only from intended networks
`ProxyRequests`	`On`	Enables forward-proxy processing	Never enable it without client authorization
`ProxyVia`	`On`	Adds proxy-related `Via` headers	Consider header visibility and operational requirements
`Proxy`	`<Proxy "*">`	Defines rules for proxy request targets	Place restrictive authorization inside the container
`Require ip`	`192.168`	Allows clients from 192.168.0.0/16	Confirm that the range is trusted and matches observed client addresses
`ErrorLog`	`error_forward_proxy.log`	Records proxy errors and failures	Protect logs because they may contain network and request details
`CustomLog`	`access_forward_proxy.log combined`	Records proxy requests in combined format	Monitor for unexpected clients, destinations, and volume

Configure a client to use the proxy

A client must target the Apache proxy rather than connect directly to the external site. In an operating-system or browser proxy dialog, provide these values:

Proxy hostname or IP address: the address of the Apache server
Proxy port: 8080
HTTP and HTTPS: select whether the same proxy is used for both protocols

For command-line programs, use the program's proxy option or its supported proxy environment variables. The following curl commands explicitly select the Apache proxy.

Validate HTTP and HTTPS proxying

Run these commands from an approved client. Replace PROXY_HOST with the Apache server's hostname or IP address.

curl -x http://PROXY_HOST:8080 http://example.com/
curl -x http://PROXY_HOST:8080 https://example.com/

The first command tests ordinary HTTP proxying through mod_proxy_http. The second tests HTTPS tunneling through the CONNECT method and therefore exercises mod_proxy_connect.

After each test, inspect the dedicated logs:

sudo tail -f /var/log/apache2/access_forward_proxy.log
sudo tail -f /var/log/apache2/error_forward_proxy.log

The access log helps confirm that the request reached Apache and shows the client address, request target, status, and transfer details in the standard combined format. The error log helps diagnose authorization failures, upstream connection problems, and CONNECT errors.

Confirm the listener and firewall exposure

Confirm that Apache is listening on the intended port using a local socket inspection command:

sudo ss -ltnp | grep ':8080'

Also verify that the local firewall and any network firewall allow TCP port 8080 only from the approved client networks. A listener that is reachable from the public internet is unsafe unless it has strong, tested controls appropriate for that exposure.

Troubleshooting

Apache does not start

Run sudo apache2ctl configtest and correct the reported syntax error.
Confirm that the proxy modules are enabled.
Check whether another service already uses port 8080.
Inspect the dedicated error log and the system service status for additional details.

The client cannot connect to port 8080

Confirm that Listen 8080 exists in /etc/apache2/ports.conf.
Confirm that forward_proxy.conf is enabled.
Restart or reload Apache after the change.
Use ss to verify the listening address and port.
Check local and network firewall rules and general network reachability.

The proxy returns forbidden or access-denied

Identify the client's actual source IP address as Apache sees it.
Check whether that address belongs to the allowed 192.168.0.0/16 range.
Review the authorization block inside <Proxy "*">.
Inspect the access and error logs for authorization failures.

HTTP works but HTTPS fails

Verify that proxy_connect is enabled.
Confirm that the client is configured to use the proxy for HTTPS as well as HTTP.
Run the HTTPS curl test and review the error log for CONNECT-related messages.
Check whether a firewall or network policy blocks CONNECT traffic or the destination connection.

Untrusted networks can use the proxy

Check that the Proxy authorization block exists and is not overly broad.
Review whether ProxyRequests On was enabled globally without a restrictive policy.
Restrict firewall access to the intended internal ranges.
Test from an unauthorized network and confirm that Apache denies the request.

Operational checklist

Enable proxy, proxy_http, and proxy_connect.
Create the dedicated virtual host in sites-available.
Add matching Listen 8080 and VirtualHost *:8080 settings.
Keep ProxyRequests On paired with restrictive client authorization.
Enable the site and run apache2ctl configtest.
Restart or reload Apache.
Confirm the listener and firewall scope.
Test HTTP and HTTPS from an authorized client.
Test denial from an unauthorized client.
Review the dedicated access and error logs.

For related Apache administration, see Install Apache on Ubuntu, sites-available, ports.conf, and Apache access and error logs.