I am using a long CIDR blacklist to block several countries from a site, but I need to allow specific IP addresses within the blocked CIDR ranges. Here's an excerpt of my conf file (this is the order that I am currently trying, though I have tried moving the "allow" lines above the "deny" lines as well):
order allow,deny deny from 184.108.40.206/22 deny from 220.127.116.11/19 deny from 18.104.22.168/20 deny from 22.214.171.124/16 # ... allow from 126.96.36.199
The blacklist works fine, but the "allow" lines are not honored whether I place them above the "deny" section or below it. Is there any other configuration that I should need to get this to work? Apache documentation led me to believe that "allow" should come after "deny," but it did not seem to answer this question directly either way.