Suppose you have something like: ProxyPreserveHost On ProxyRequests off ProxyPass / http://192.168.2.28/ ProxyPassReverse / http://192.168.2.28/ But you want to restrict access to this site to a certain set of IP addresses. Allow/deny statements aren't allowed in the base of the <virtualhost> directive, and this isn't a <directory>... the way to apply allow/deny statements to the above is: <Proxy *> Order deny,allow Deny from all Allow from internal.example.com </Proxy>