Did you get a chance to try exactly as mentioned in your example file - SetEnvIf X-FORWARDED-FOR <IP REGEX> AllowIP # it assumes that your LB is setting X-FORWARDED-FOR header with incoming IPor if its a single IP/CIDR block-Allow from XXX.XXX.XX.X/XX Order deny,allowDeny from allAllow from env=...