Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using a long CIDR blacklist to block several countries from a site, but I need to allow specific IP addresses within the blocked CIDR ranges. Here's an excerpt of my conf file (this is the order that I am currently trying, though I have tried moving the "allow" lines above the "deny" lines as well):

order allow,deny
deny from
deny from
deny from
deny from
# ...
allow from

The blacklist works fine, but the "allow" lines are not honored whether I place them above the "deny" section or below it. Is there any other configuration that I should need to get this to work? Apache documentation led me to believe that "allow" should come after "deny," but it did not seem to answer this question directly either way.

share|improve this question
up vote 5 down vote accepted

The Apache manual section on mod_authz_host is instructive here. The order of your allow and deny statements does not matter. With order allow,deny, you must match at least one allow and no deny directives for your request to be accepted. I think you want order deny,allow.

share|improve this answer
+1 from me for referencing authoritative documentation, and summarising it, too. – MadHatter Apr 12 '11 at 8:53

Apache first processes all Deny and all Allow directives. Then works it's way through them matching rules based on the Order statement - the last match wins. This means that your deny from rule will be matched after your allow from rule and you are denied access. To solve this change the Order to Order Deny,Allow.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.