7

I've upgraded Apache 2.4 and would like to block an Ip this could be done by using the following in the .htaccess on Apache 2.2

Order Deny,Allow
Deny from 50.62.136.183

However how can I achieve the same in the .htaccess on Apache 2.4

5 Answers 5

13

This is another acceptable syntax for .htaccess file:

<RequireAll>
Require all granted
Require not ip 50.62.136.183
</RequireAll>

This syntax is recommended for 2.4 because the order-deny syntax will not always work, as can be seen here http://httpd.apache.org/docs/2.4/upgrading.html

2
  • 2
    it is not true. It is just different way of doing the same thing, so don't accuse others.
    – Jakuje
    Jan 18, 2016 at 20:19
  • @Jakuje I've edited the user's answer to be somewhat more polite...
    – shodanshok
    Jan 20, 2016 at 11:50
9

Apache 2.4 makes some big changes in the way it authorizing users.

Authorization components in Apache 2.4 can now use the Require syntax that was previously only available for authentication. This change simplifies the way to define authorization order. The rule sets previous to 2.4 rather could geth pretty complex. The rules in 2.4 are a more logical, specifying a default and then exceptions.

You are asking as a default for accepting traffic, but wish to block a specific IP, the rule would look something like this:

Require all granted
Require not ip 50.62.136.183

This rule will set a default policy of accepting all IP's except any request coming from the 111.111.111.111 IP address.

Examples of before and after Apache 2.4

Apache 2.2

<files somefile.php>
  order allow,deny
  deny from 50.62.136.183
</files>

Apache 2.4

<Files somefile.php>
Require all granted
Require not ip 50.62.136.183
</Files>

Don't forget to block access to your .htaccess file or a quick google search my render your site vulnerable. I have included the pre 2.4 and post 2.4 configuration.

Apache 2.2

# Prevent .htaccess files from being spidered or viewed via a web browser.
<FilesMatch "^\.ht">
  Order allow,deny
  Deny from all
  satisfy all
</FilesMatch>

Apache 2.4

# Prevent .htaccess files from being spidered or viewed via a web browser.
<Files ".ht*">
  Require all denied
</Files>
4
  • I keep getting 500 error when "Require all denied" is included in the .htaccess file. Error log states "Require not allowed here"
    – Oudin
    Aug 17, 2015 at 17:06
  • I just double checked the documentation and it looks right to me: httpd.apache.org/docs/2.4/upgrading.html Is mod_authz_core loaded? Aug 19, 2015 at 4:43
  • Doesn't this throw an error for anyone else running apache 2.4? I get something to the effect of "negative statement has no effect in require any".
    – Shmack
    Oct 9, 2022 at 23:36
  • I wrote it several years ago. My curiosity has been piqued, and I'll have to research further. Jan 8, 2023 at 7:24
3

The configuration of access control has changed, as you can read in http://httpd.apache.org/docs/2.4/upgrading.html#access so you should use the Require directive:

Require all granted
Require not ip 50.62.136.183

If you add that to your .htaccess file (or a Directory section) it should work as you asked.

2

To Deny visitors by IP address you can put below entry in .htaccess

Order Deny,Allow
Deny from 198.51.100.5

To block IP Range Example:

RewriteEngine on
RewriteCond %{REMOTE_ADDR} ^00\.00\.00\.
RewriteRule ^ - [F]

To Redirect unwanted visitor to another url:

RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http(s)?://(www\.)?169.166.0.5.*$ [NC]
RewriteRule .* 198.51.100.6 [L]

Note: given IP address are Example IPs.

0

I had error 500 on ionos mutualised servers. The PB came from command order,allow,deny which not work anymore. I change for <RequireAll> Require all granted Require not ip 50.62.136.183 </RequireAll> I tried with my own complet IPV6 and it works ... but I can set just beginnin of IPV4 but not IPV6 !? (maybe, IPV6 doesn't work as IPV4 concerning first number determining a country, so no way to do that ...) So, this works <RequireAll> Require all granted Require not ip 50.62 </RequireAll> But this doesn't work : <RequireAll> Require all granted Require not ip 20a6:5bd2 </RequireAll>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .