Return to Answer

Code for the current version of Apache (2.4)

Require ip xx.yy.zz.kk
Require all denied

Is it possible to have access from other IP address?

No, unless the source IP gets spoofed by the attacker

Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?

Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks

References:

• How easy is it really to do IP spoofing?

• https://www.cloudflare.com/en-gb/learning/ddos/glossary/ip-spoofing/

In particular, while a very single packet can be spoofed at no cost, you should both know that 1) it won't likely survive your ISP's first hop, and that 2) it takes fully stealing an IP address class in order to fully establish and maintain a TCP session to a firewalled box. This BGP hijacking is something you can't realistically do home, as you need large control over network and BGP routes. Network providers are aware of this threat and are working on multiple solutions, like authentication, RPKI (RFC 8210) and the BGPSec protocol (RFC 8205), to mitigate.

Conclusion: as for your firewall, it will work as expected and you can rest assured. Further comment: you may also like defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level

Code for the current version of Apache (2.4)

Require ip xx.yy.zz.kk
Require all denied

Is it possible to have access from other IP address?

No, unless the source IP gets spoofed by the attacker

Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?

Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks

References:

• How easy is it really to do IP spoofing?

• https://www.cloudflare.com/en-gb/learning/ddos/glossary/ip-spoofing/

In particular, while a very single packet can be spoofed at no cost, you should both know that 1) it won't likely survive your ISP's first hop, and that 2) it takes fully stealing an IP address class in order to fully establish and maintain a TCP session to a firewalled box. This BGP hijacking is something you can't realistically do home, as you need large control over network and BGP routes. Network providers are aware of this threat and are working on multiple solutions, like authentication, RPKI (RFC 8210) and the BGPSec protocol (RFC 8205), to mitigate.

Conclusion: as for your firewall, it will work as expected and you can rest assured. Further comment: you may also like defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level

Code for the current version of Apache (2.4)

Require ip xx.yy.zz.kk
Require all denied

Is it possible to have access from other IP address?

No, unless the source IP gets spoofed by the attacker

Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?

Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks

References:

• How easy is it really to do IP spoofing?

• https://www.cloudflare.com/en-gb/learning/ddos/glossary/ip-spoofing/

In particular, while a very single packet can be spoofed at no cost, you should both know that 1) it won't likely survive your ISP's first hop, and that 2) it takes fully stealing an IP address class in order to fully establish and maintain a TCP session to a firewalled box. This is something you can't realistically do home, as you need large control over network and BGP routes. Network providers are aware of this threat and are working on multiple solutions, like authentication and the BGPSec protocol, to mitigate.

Conclusion: as for your firewall, it will work as expected and you can rest assured. Further comment: you may also like defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level

Code for the current version of Apache (2.4)

Require ip xx.yy.zz.kk
Require all denied

Is it possible to have access from other IP address?

No, unless the source IP gets spoofed by the attacker

Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?

Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks

References:

• How easy is it really to do IP spoofing?

• https://www.cloudflare.com/en-gb/learning/ddos/glossary/ip-spoofing/

In particular, while a very single packet can be spoofed at no cost, you should both know that 1) it won't likely survive your ISP's first hop, and that 2) it takes fully stealing an IP address class in order to fully establish and maintain a TCP session to a firewalled box. This BGP hijacking is something you can't realistically do home, as you need large control over network and BGP routes. Network providers are aware of this threat and are working on multiple solutions, like authentication, RPKI (RFC 8210) and the BGPSec protocol (RFC 8205), to mitigate.

Conclusion: as for your firewall, it will work as expected and you can rest assured. Further comment: you may also like defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level

Code for the current version of Apache (2.4)

Require ip xx.yy.zz.kk
Require all denied

Is it possible to have access from other IP address?

No, unless the source IP gets spoofed by the attacker

Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?

Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks

References:

• How easy is it really to do IP spoofing?

• https://www.cloudflare.com/en-gb/learning/ddos/glossary/ip-spoofing/

In particular, while a very single packet can be spoofed at no cost, fully stealing an IP address in order to fully establish a TCP session is something you can't realistically do unless you have control over network and BGP routes, which historically were not authenticated

Conclusion: as for your firewall, it will work as expected. Comment: do not forget defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level

Code for the current version of Apache (2.4)

Require ip xx.yy.zz.kk
Require all denied

Is it possible to have access from other IP address?

No, unless the source IP gets spoofed by the attacker

Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?

Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks

References:

• How easy is it really to do IP spoofing?

• https://www.cloudflare.com/en-gb/learning/ddos/glossary/ip-spoofing/

In particular, while a very single packet can be spoofed at no cost, you should both know that 1) it won't likely survive your ISP's first hop, and that 2) it takes fully stealing an IP address class in order to fully establish and maintain a TCP session to a firewalled box. This is something you can't realistically do home, as you need large control over network and BGP routes. Network providers are aware of this threat and are working on multiple solutions, like authentication and the BGPSec protocol, to mitigate.

Conclusion: as for your firewall, it will work as expected and you can rest assured. Further comment: you may also like defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level