Ubuntu – Apache “allow from” rule only works with ip addresses

Shouldn't it be

<IfModule proxy_module>
  <IfModule proxy_http_module>

    <Proxy *>
      Order Deny,Allow
      Deny from all
      Allow from some.approved.list
    </Proxy>

  </IfModule>
</IfModule>

to redirect main.com/image.jpg (I understand we'll have to do a 301) to cdn.main.com/image.jpg

This is a bad idea, don't do it.

Your long question is kind of hard to follow. As I understand it, you're worried about the server load, not how fast the site loads for your end users.

If you're worried about server capacity, either:

• Get a bigger server or
• Use a in-RAM proxy server in front of your HTTP server (Squid, Varnish, Apache Traffic Server) or
• Use a inexpensive Content Delivery Network to cache your static content closer to the end users, reducing both page load time and load on your servers.

thus the browser being able to have more connections.

The browser parallel download limit is a little bit of a red herring -- modern browsers download 6-8 files in parallel from the same hostname. It's only old browsers (IE6, IE7) which really suffer from this limitation.

If you're worried about the end user's page load speed, then use a CDN, that's good advice in all situations were your users are spread out over a large geographical area (ie you have a global audience).

301s of all images on a page be penalized by google?

Possibly. But more likely, it will be hated by your users. For each image request you're first serving a 301, and then the correct image from another URL. That means 2 round trips to the servers for every single image, and hence significantly longer page load time for your users.