Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using a long CIDR blacklist to block several countries from a site, but I need to allow specific IP addresses within the blocked CIDR ranges. Here's an excerpt of my conf file (this is the order that I am currently trying, though I have tried moving the "allow" lines above the "deny" lines as well):

order allow,deny
deny from 27.116.56.0/22
deny from 58.147.128.0/19
deny from 61.5.192.0/20
deny from 83.140.0.0/16
# ...
allow from 83.140.19.38

The blacklist works fine, but the "allow" lines are not honored whether I place them above the "deny" section or below it. Is there any other configuration that I should need to get this to work? Apache documentation led me to believe that "allow" should come after "deny," but it did not seem to answer this question directly either way.

share|improve this question
add comment

2 Answers 2

up vote 5 down vote accepted

The Apache manual section on mod_authz_host is instructive here. The order of your allow and deny statements does not matter. With order allow,deny, you must match at least one allow and no deny directives for your request to be accepted. I think you want order deny,allow.

share|improve this answer
    
+1 from me for referencing authoritative documentation, and summarising it, too. –  MadHatter Apr 12 '11 at 8:53
add comment

Apache first processes all Deny and all Allow directives. Then works it's way through them matching rules based on the Order statement - the last match wins. This means that your deny from 83.140.0.0/16 rule will be matched after your allow from 83.140.19.38 rule and you are denied access. To solve this change the Order to Order Deny,Allow.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.