AllowCONNECT

AllowCONNECT is a directive used in the Apache HTTP Server, specifically within the mod_proxy module, to control the use of the HTTP CONNECT method when the server operates as a forward proxy. It restricts which remote ports may be accessed through a tunnel established by CONNECT, helping to prevent unauthorized or potentially harmful tunneling.

The directive works by listing allowed destination ports. When a client issues a CONNECT request to the proxy, the server checks the target port against the allowed list. If the port is not included, the request is denied, typically with a 403 Forbidden response. This provides a security measure to limit tunneling to trusted services or ports.

Syntax and context

- Syntax: AllowCONNECT port [port] ...

- Context: server config and virtual host

- Typically used in conjunction with ProxyRequests On to enable forward proxy behavior.

Example

<IfModule mod_proxy.c>

ProxyRequests On

AllowCONNECT 443

</IfModule>

In this example, the proxy will only allow CONNECT tunnels to port 443 (commonly used for HTTPS). Administrators may adjust the list to match organizational needs, such as adding 443 and 563 for secure tunneling or restricting to a smaller subset for tighter security.

Security and considerations

AllowCONNECT helps mitigate abuse by limiting tunneling destinations, reducing potential data exfiltration through a proxy, and limiting access to sensitive internal services. It should be used as part of a broader proxy hardening strategy, including access controls, auditing, and regular log review. The directive is specific to Apache’s mod_proxy and is not a universal setting across all proxy servers.

---