# How to restrict access for a back-end just to the internal network

**URL:** <https://discourse.haproxy.org/t/how-to-restrict-access-for-a-back-end-just-to-the-internal-network/3223>\
**Category:** Help!\
**Created:** [November 14, 2018, 10:45am UTC](https://discourse.haproxy.org/t/how-to-restrict-access-for-a-back-end-just-to-the-internal-network/3223 "2018-11-14T10:45:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hadi](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/hadi/32/506_2.png) [@hadi](https://discourse.haproxy.org/u/hadi)\
**Post date:** [November 14, 2018, 10:45am UTC](https://discourse.haproxy.org/t/how-to-restrict-access-for-a-back-end-just-to-the-internal-network/3223/1 "2018-11-14T10:45:14Z")

</div>

Hi,

I have an HAProxy with more than twenty backends and I need to limit access to one specific backend, `CP-API.MACKMIL.COM`, to the following internal network subnets:  
`10.10.0.0/16`  
`10.20.0.0/16`  
`10.30.0.0/16`  
`10.40.0.0/16`

Currently, with the following query, this domain, `CP-API.MACKMIL.COM`, can be accessed from the outside world but I want to limit that.  
`curl -vvv -H'Host: cp-api.mackmil.com' https://api.mackmil.com/initializations`

My Haproxy config is as follows,

> frontend http-https  
> bind :80 accept-proxy  
> bind :443 accept-proxy ssl crt /etc/pki/tls/private/wildcard.mackmil.com.pem crt /etc/pki/tls/private/wildcard.mackmil.de.pem
> 
> ```
> acl host_cp hdr(host) -i cp-api.mackmil.com
> acl host_cp hdr(host) -i cp-api.prod.mackmil.com
> 
> use_backend app_cp if host_cp
> 
> ```
> 
> backend app\_cp  
> server swarm-worker\_10.10.30.199 10.10.30.199:64042 check  
> server swarm-worker\_10.10.40.114 10.10.40.114:64042 check  
> server swarm-worker\_10.20.40.159 10.20.40.159:64042 check  
> server swarm-worker\_10.20.30.190 10.20.30.190:64042 check  
> server swarm-worker\_10.30.40.143 10.30.40.143:64042 check  
> server swarm-worker\_10.30.40.161 10.30.40.161:64042 check  
> server swarm-worker\_10.40.40.107 10.40.40.107:64042 check  
> server swarm-worker\_10.40.40.107 10.40.40.107:64042 check

I am struggling on applying this restriction in HTTP/HTTPS mode for just this endpoint. How can I apply this restrication for this backend?

Thank you very much in advance for your answers.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [November 14, 2018, 7:41pm UTC](https://discourse.haproxy.org/t/how-to-restrict-access-for-a-back-end-just-to-the-internal-network/3223/2 "2018-11-14T19:41:24Z")

</div>

Put this in that backend:

```
acl internal_subnets src 10.10.0.0/16
acl internal_subnets src 10.20.0.0/16
acl internal_subnets src 10.30.0.0/16
acl internal_subnets src 10.40.0.0/16
http-request deny if ! internal_subnets
```