I am using a long CIDR blacklist to block several countries from a site, but I need to allow specific IP addresses within the blocked CIDR ranges. Here's an excerpt of my conf file (this is the order that I am currently trying, though I have tried moving the "allow" lines above the "deny" lines as well):

order allow,deny
deny from
deny from
deny from
deny from
# ...
allow from

The blacklist works fine, but the "allow" lines are not honored whether I place them above the "deny" section or below it. Is there any other configuration that I should need to get this to work? Apache documentation led me to believe that "allow" should come after "deny," but it did not seem to answer this question directly either way.


The Apache manual section on mod_authz_host is instructive here. The order of your allow and deny statements does not matter. With order allow,deny, you must match at least one allow and no deny directives for your request to be accepted. I think you want order deny,allow.

  • +1 from me for referencing authoritative documentation, and summarising it, too. – MadHatter Apr 12 '11 at 8:53

Apache first processes all Deny and all Allow directives. Then works it's way through them matching rules based on the Order statement - the last match wins. This means that your deny from rule will be matched after your allow from rule and you are denied access. To solve this change the Order to Order Deny,Allow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.