Ubuntu 16.04 / phpMyAdmin / How to Make It Accessible Only from Specific IPs

To restrict the IP addresses that can access phpMyAdmin in Apache 2.4, use Require ip in the access settings of the phpMyAdmin directory. Specify the allowable addresses, check the configuration syntax, and then reload Apache. The access will then be permitted only for the specified addresses on the paths where the settings are applied.

Scope of application and prerequisites

This article uses the example of phpMyAdmin installed from the package on Ubuntu, served directly by Apache 2.4, where the /usr/share/phpmyadmin directory is used in its configuration. The installation method, virtual host, aliases, and location of configuration files vary depending on the environment. Do not apply this example as-is for setups using Nginx, containers, or separate proxies.

The standard security support for Ubuntu 16.04 LTS ended in April 2021, and Ubuntu Pro support ended in May 2026. Check the conditions for additional Legacy support and plan to migrate to a supported version. You can check the detailed schedule at Ubuntu Security Maintenance Schedule.

If settings are applied incorrectly, even administrators may be unable to access the system. Before making changes, secure console or SSH access to the server, and verify the actual IP addresses of administrators allowed to access and the path used by phpMyAdmin. When accessing via the internet, generally the public IP seen by the server is required rather than the private IP of the management PC. The address seen by the server can vary depending on VPN, proxy, NAT, and IPv6 usage.

Current Apache Configuration Check and Backup

Check the aliases and directory settings of phpMyAdmin in the Apache version and active configuration. If the following files do not exist, locate the actual configuration file according to the installation method. The following search results may include settings that are not active, so verify active settings and virtual hosts as well.

apache2 -v
sudo apache2ctl -S
sudo grep -R -n -i phpmyadmin /etc/apache2/conf-enabled /etc/apache2/sites-enabled

If the package configuration exists in /etc/apache2/conf-available/phpmyadmin.conf and that configuration is active, back it up before making changes. If the backup files below already exist, assign a different name so as not to overwrite them.

sudo cp -a /etc/apache2/conf-available/phpmyadmin.conf /etc/apache2/conf-available/phpmyadmin.conf.before-ip-restriction

Open the actual configuration file with a text editor and find the <Directory /usr/share/phpmyadmin> section. For example, you can edit it with the following command.

sudo nano /etc/apache2/conf-available/phpmyadmin.conf

Setting allowed IP addresses

After checking the access permission rules in the existing phpMyAdmin directory section, set the approval rules that apply to that section as follows. The addresses below are examples for explanation purposes, so be sure to replace them with the administrator's actual addresses. Keep the existing PHP processing or other necessary settings in the original section.

<Directory /usr/share/phpmyadmin>
    Require ip 192.0.2.10
</Directory>

The above block is an example showing the access control part. Do not delete the entire existing directory section and paste it as is. If you place Require all granted and Require ip side by side in the same section, access may be allowed if either one is permitted, so review the existing approval rules to ensure that the intended restrictions are actually applied. Other Directory or Location sections or authentication settings may also affect the results, so check the entire configuration.

If there are multiple addresses, you can list them separated by spaces. For example, the following rule allows access if it matches either of the two addresses. If you specify a network range, the entire range will be allowed, so specify only the necessary range. IPv6 addresses and CIDR notation are also supported.

Require ip 192.0.2.10 198.51.100.25

The Order, Deny, and Allow directives are legacy syntax supported for compatibility in Apache 2.4. Avoid mixing old and new rules indiscriminately; review the existing configuration and any other authentication requirements before migrating to the current syntax. See Apache's access control guide and Require ip documentation for address formats and scope.

Syntax check, application, and connection verification

1. After saving the file, check the syntax of the entire Apache configuration with the following command. If Syntax OK does not appear, check and correct the file and line of the error. The syntax check does not guarantee that the access policy will operate as intended.

sudo apache2ctl configtest

2. If the syntax check is successful, reload the configuration and check the service status. The service name may vary depending on the distribution.

sudo systemctl reload apache2
sudo systemctl status apache2

3. Access phpMyAdmin from an allowed network using its existing address. If you pass the access control, the login screen may appear, but a separate database login is required.
4. Check the same address from a separate network not included in the allowlist. If the relevant Apache rule applies and there are no other errors, 403 Forbidden is generally displayed. If an allowed address is blocked or a disallowed address can open the page, check the server logs, applicable configuration sections, proxy, and IP addresses.

Proxy Environment and Additional Security

If Apache is behind a reverse proxy or load balancer, it may see the proxy's IP instead of the actual user. In this state, allowing the proxy address can give access to more users than intended, so be cautious. To use the actual client address, it is necessary to configure only trusted proxies. Do not blindly trust headers sent by arbitrary clients; after checking the Apache mod_remoteip documentation , configure according to your network setup.

IP restrictions do not replace phpMyAdmin login or database permission management. Use HTTPS and limit account permissions to the necessary scope. If public IPs change frequently in your environment, rather than blindly allowing a wide address range, consider access paths such as VPNs.

Connection Issues and Reverting Settings

If access is blocked, check the administrator’s current public IP, IPv4 and IPv6 routes, whether the configuration file is active, and whether approval rules from other zones are applied. The location of the Apache error logs depends on the configuration, and in the default Ubuntu setup, you can check /var/log/apache2/error.log. Be careful when sharing logs, as they may contain sensitive information.

If you need to revert changes, first compare to ensure that no one else has modified the files since the backup, restore the backup file to its original path, then run a syntax check and reload. Restoring to the previous configuration may allow previously permitted access again, so check the access scope after restoration.

sudo cp -a /etc/apache2/conf-available/phpmyadmin.conf.before-ip-restriction /etc/apache2/conf-available/phpmyadmin.conf
sudo apache2ctl configtest && sudo systemctl reload apache2

If a syntax check results in errors, do not reload; fix the configuration instead. Also verify that the intended login and access restrictions are maintained in both permitted and non-permitted environments.