Apache Listen and VirtualHost Settings for a Forward Proxy
Add the intended Apache listener separately from a forward-proxy VirtualHost instead of treating a configured port as an active socket.
A <VirtualHost> block describes how Apache should handle matching requests. It does not create the listening socket. A forward-proxy configuration on port 8080 can therefore exist in a valid-looking file while clients find no listener there.
The Listen directive supplies that separate requirement. For a proxy reached only through a local client or protected tunnel, the intended shape might include:
Listen 127.0.0.1:8080
<VirtualHost 127.0.0.1:8080>
# Existing restricted forward-proxy configuration
</VirtualHost>This illustrates the relationship, not a complete proxy deployment. Preserve the existing client authorization and destination restrictions. The loopback address intentionally does not offer a new public proxy listener.
Check the effective configuration for overlapping Listen entries too. Adding another directive without noticing an existing listener can prevent startup. Apache's supported restart procedure also matters when moving from a specific address to an overlapping wildcard binding.
When SSH forwards to this proxy, the far end must reach an actual listener. A successful SSH login does not make the configured Apache port exist. Correct the listener and intended binding before changing HTTP credentials or weakening an access rule. Then verify the permitted and denied access cases on the actual listener.