Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running CentOS 5.5 with the stock Apache httpd-2.2.3.

I have enabled mod_status at the Location /server-status. I would like to allow access to this single Location in the following way:

  1. Deny from all
  2. Allow from the subnet
  3. Deny from a the IP, which is within the subnet.

1 & 2 are easy. However, since I "Allow from", is it possible to Deny from

I tried to add a Deny statement for but it doesn't work. Here is the relevant config:

<Location /server-status>
    SetHandler server-status
    Order Allow,Deny
    Deny from  all
    Deny from # This does not deny access from
    Allow from


<Location /server-status>
    SetHandler server-status
    Order Allow,Deny
    Deny from  all
    Deny from # This does not deny access from
    Allow from

However, this doesn't prevent access to this particular page, as demonstrated in the Access logs: - - [11/Mar/2011:16:01:14 -0800] "GET /server-status HTTP/1.1" 200 9966 "-" "

According to the manual for mod_authz_host:


First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any matches, the request is rejected

The IP address matches the Deny directive, so shouldn't the request be rejected?

According to the table on the mod_authz_host page, this IP address should "Match both Allow & Deny", and thus the "Final match controls: Denied" rule should apply.

    Match                       Allow,Deny result                   Deny,Allow result
    Match Allow only            Request allowed                     Request allowed
    Match Deny only             Request denied                      Request denied
    No match                    Default to second directive: Denied Default to second directive: Allowed
    Match both Allow & Deny     Final match controls: Denied        Final match controls: Allowed
share|improve this question
Deny from all -- Since you are using "all" here, I would expect all requests to be denied from any IP address. Think something else is going on here. – micah Apr 6 '11 at 19:48
@Michah: I am also doing a Allow from As I understand the documentation, any requestor IPs in the network will match this Allow statement, the request is allowed. – Stefan Lasiewski Apr 6 '11 at 20:34
Following the documentation pasted above. "First, all Allow directives are evaluated; at least one must match, or the request is rejected" ==> This should match your "Allow from", but the second part of "Next, all Deny directives are evaluated. If any matches, the request is rejected" With "Deny from all", won't every request match that second part and therefore be denied? – micah Apr 11 '11 at 15:10
You should really consider if you want to deny that IP address complete access to your system or only from httpd. If the former continue with your approach at using apache directives. If the latter this should be done in the firewall. – Andrew Case Oct 7 '11 at 17:20
Thanks ACase. I only want to deny access from this particular page. I want to be able to access all other pages on this webserver. – Stefan Lasiewski Oct 7 '11 at 19:01
up vote 27 down vote accepted

I haven't tested, but I think you are almost there.

<Location /server-status>
    SetHandler server-status
    Order Allow,Deny
    Deny from
    Allow from

Deny from all is not needed. In fact it will screw up because everything will match all, and thus denied (and I think Apache is trying to be smart and do something stupid). I have always found Apache's Order, Allow and Deny directives confusing, so always visualize things in a table (taken from the docs):

Match      | Allow,Deny result   | Deny,Allow result
Allow only | Allowed             | Allowed
Deny only  | Denied              | Denied
No match   | Default: Denied     | Default: Allowed
Match both | Final match: Denied | Final match: Allowed

With the above settings:

  • Requests from get "Match both" and thus denied.
  • Requests from get "Allow only" and thus allowed.
  • Requests from get "No match" and thus denied.
share|improve this answer
Thanks! This works. – Stefan Lasiewski Oct 7 '11 at 23:20

I would probably look at also adding IPTables rules for this to deny the single host on port 80, deny from all, and allow the subnet.

You should have no problem setting up a deny rule from a specific address after you have allowed the subnet. Just do it in that order.

share|improve this answer
I've updated my answer. I included a "Deny from" rule, but access is still allowed from – Stefan Lasiewski Mar 11 '11 at 20:57
I want to allow access to all other locations from this host. However, I want to Deny specific locations. IPTables does not help me here. – Stefan Lasiewski Mar 11 '11 at 21:00
IPTables will not specifically deny outbound traffic unless you tell it to. You can however, deny inbound traffic from world, and a specific address, but all allow a subnet. – Mike Mar 11 '11 at 21:29
I think you misunderstand my request. I want to apply this access control to /server-status only, not the entire host. IPtables cannot do this easily, to my knowledge. – Stefan Lasiewski Apr 5 '11 at 15:23

Can you use php? If so add a php statement to exit/redirect for that one specific IP address


$deny = array("111.111.111", "222.222.222", "333.333.333");

if (in_array ($_SERVER['REMOTE_ADDR'], $deny))

{ header("location:");



share|improve this answer
This would have to be in every single page hosted by the webserver. This solution is impractical and not where you would want to filter access to a webserver. – Andrew Case Oct 7 '11 at 17:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.