Reverse Proxy

If you want to use a subdomain for the ZNC-Webinterface, you have to create a Reverse Proxy with your webserver.
Without setting TrustedProxy in your config you will only see 127.0.0.1 or ::1 for each web-access in your logs => You can't block specific IP's
If you want to see the real IP's you have to add this to your config:

TrustedProxy = 127.0.0.1
TrustedProxy = ::1

Nginx

As subdomain

server {
    listen 80;
    listen [::]:80;
    server_name znc.domain.tld;

    location / {
        proxy_pass http://[::1]:6667/;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

As subdirectory

Set URIPrefix of the Listener in ZNC to /znc/

server {
    ...
    location /znc/ {
        proxy_pass http://127.0.0.1:1026;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Note there is no / after the port number.

lighttpd

$HTTP["host"] =~ "^(sub\.domain\.com)$" {
  proxy.server = ( "" => ( ( "host" => "127.0.0.1", "port" => 6667 ) ) )
}