Allow and/or Deny of CIDR Value Woes

Question

I'm having some issues messing around with Allow/Deny, I've spent about 3 hours messing with it so far and have only frustration as a result. I've read the Apache docs and several guides and I'm still stuck.

My issue is extremely simple or at least I feel that it should be... I want to block a CIDR range from hitting a particular area of my host. In my testing server I've tried as far as I can tell every possibility of this..

<LocationMatch "/myjunk/.+">
    <IfModule mod_access.c>
        Order Deny,Allow
        Deny from 10.1.1.100/32
        Allow from All
    </IfModule>
</LocationMatch>

I've verified in my log file that I'm actually coming from 10.1.1.100, I've tried: switching to Order Allow,Deny; leaving off the /32; switching the Allow and Deny lines and switching the Order around. If I remove the Allow from and set to Deny from All, I get the 403 which I want.

Snippet from log file:

15128 10.1.1.100 192.168.1.100 - - [01/Nov/2011:17:36:54 -0400] "GET /myjunk/abc/def/1 HTTP/1.1" 200 8000

I'm running Apache/2.0.58 on an old Solaris box, unfortunately there's nothing I can do to change that. I have full access to the server, I can modify the httpd.conf file directly.

I have a feeling that I've overlooked something or just missing something small.

Answer 1

Change Order Deny,Allow to Order Allow,Deny and try again.

Keep in mind that, with deny,allow order, deny directive is evaluated before the allow directive. If the client does not match deny rule or it does match allow rule, then it will be granted access.

In contrary with allow,deny: if the client does not match the allow rule or it does match deny rule, then it will be denied access.