From: Joe Orton <jorton@apache.org>
Date: Mon, 20 Jul 2026 11:47:48 +0000 (+0000)
Subject: Merge r1935589 from trunk:
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bdac3480391455aff996cb8c26807b556abc3cd0;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1935589 from trunk:

* docs/manual/mod/mod_proxy.xml: Add clarifications for ProxyRemote and
  <Proxy> containers.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1936368 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/mod/mod_proxy.xml b/docs/manual/mod/mod_proxy.xml
index f0fd7ece6d..afd6d99c61 100644
--- a/docs/manual/mod/mod_proxy.xml
+++ b/docs/manual/mod/mod_proxy.xml
@@ -505,7 +505,7 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10
 
 <usage>
     <p>Directives placed in <directive type="section">Proxy</directive>
-    sections apply only to matching proxied content.  Shell-style wildcards are
+    sections apply only to matching proxied content using a simple string prefix match against the URL.  Shell-style wildcards are also
     allowed.</p>
 
     <p>For example, the following will allow only hosts in
@@ -713,6 +713,13 @@ ProxyRemote "ftp" "http://ftpproxy.mydomain:8080"
     authentication challenge.  The <a
     href="mod_proxy_http.html#env">Proxy-Chain-Auth</a> environment
     variable has no effect if this argument is used.</p>
+    
+    <note><title>DNS resolution and forward proxies</title>
+    <p>When a forward (remote) proxy is configured, DNS resolution of
+    the origin/backend hostname is only performed on the forward proxy.
+    Any <directive module="mod_proxy">ProxyBlock</directive> rules
+    which restrict access to specific IP addresses must be configured
+    at the forward proxy.</p></note>
 
 </usage>
 </directivesynopsis>