title: Denying access to my adserver to third-parties
body: <p>I have this situation:
  An user with IP X visit my website with IP Y. The website has an external &lt; script > tag which get information from an AdServer Z (&lt; script src=Z/script.js />) and display an Ad.</p>
  
  <p>Now, I want to block X accessing Z/script.js directly, but when the user visit the website, it display the Ad.</p>
  
  <p>I tried with an .htaccess doing this:</p>
  
  <pre><code>Order allow,deny
  Allow from Y
  Deny from all
  </code></pre>
  
  <p>But it doens't display Ads and I can't access the file directly.</p>
  
  <p>But when I did this:</p>
  
  <pre><code>Order allow,deny
  Allow from X
  Deny from all
  </code></pre>
  
  <p>The website display Ads and I can access the file directly.</p>
  
  <p>I thought that the Apache on Z would received Y as IP but apparently is receiving X.
  Why is this?
  And what can I do to protect Z from users but my website can link the files.</p>