Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I’m trying to restrict access to a web resource to the intranet of a company via .htaccess. Unfortunately, the approach via Allow from … isn’t working for me and and I don’t understand subnets well enough to troubleshoot the issue.

My IP address is (replaced the first two blocks for privacy) 1.2.70.59, the netmask is given by ifconfig as 0xffff0000, i.e. 255.255.0.0. I’ve used an IP address calculator go get the subnet from this.

An answer on Stack Overflow led me to believe that the following should work:

Order deny,allow
Deny from all
Allow from 1.2.0.0/255.255.0.0

Or, using CIDR (only showing the last line):

Allow from 1.2.0.0/16

Neither works. Nor does the following work, as implied by answer on this very site:

Allow from 1.2

In fact, not even the following works:

Allow from 127.0.0.1

But this does work:

Allow from localhost

Although I thought these two to be equivalent. Clearly, I have a gap in my understanding.

For completeness, this is the output of ifconfig | grep inet[^6]:

inet 127.0.0.1 netmask 0xff000000 
inet 1.2.70.59 netmask 0xffff0000 broadcast 1.2.255.255

What am I doing wrong?

share|improve this question
add comment

3 Answers

The solution was that I accessed the website via localhost/path/to/site rather than 1.2.70.59/path/to/site. Once I changed that, it worked.

share|improve this answer
add comment

First off, are you adding these directives in an .htaccess file or a config file? If the latter, then you need to restart Apache.

Secondly, do you have mod_authz_host enabled? In your httpd.conf, there should be a line like:

LoadModule authz_host_module modules/mod_authz_host.so

Lastly, are you sure it's not working? I.e. are you testing the right path/server? Are you sure a rewrite rule or custom error page isn't making it look like you've gained access to the page even though you're being shown a different page? Also, what's not working? Is it giving access to external IPs or denying access to internal IPs?

Clear your access log (delete the file), restart the server, and test the URL once more; then look at the access log and see what IP address was recorded and what response code was given.

There are other ways of doing it (e.g. via mod_rewrite or SetEnvIf/Allow from env=), but what you're doing should work.

share|improve this answer
1  
Actually I’m already using SetEnvIf for a different purpose since I only want to restrict access to a single (non-physical) resource and I don’t have write access to the server’s httpd.conf so I cannot use <Location>. Now, the solution of the puzzle is that I was using the wrong IP address to access the server – via localhost rather than my local network. –  Konrad Rudolph Feb 27 '12 at 16:14
    
@Konrad: Fairly common mistake. That's why it's always worth the effort to check the access logs. –  Lèse majesté Feb 27 '12 at 16:17
1  
I’d love to. Unfortunately I don’t have access to it. :-( The server configuration is irking me more and more … Apache 1, PHP 5.0 (full of bugs) … –  Konrad Rudolph Feb 27 '12 at 16:26
add comment

Try this for the .htaccess file:

order allow,deny
#partial ip addresses blocking
deny from 192.168
deny from 219

#full ip addresses blocking
deny from 64.120.232.114
deny from 64.120.141.34
allow from all
share|improve this answer
    
Actually, I want the opposite – block from everywhere except from a given range. The question is how I specify the range, since my approaches of notating the subnet don’t work. –  Konrad Rudolph Feb 27 '12 at 14:36
    
Then do: order deny,allow and do allow from 127.0.0.1 and such. Just switch the allows and deny's –  ionFish Feb 27 '12 at 14:40
    
But that’s exactly what I’m already doing, and it’s not working. –  Konrad Rudolph Feb 27 '12 at 14:45
    
In your httpd.conf, is there a line saying allow-override none, specifically near an IP-restricting code like in my post? If so, change to "allow-override all" –  ionFish Feb 27 '12 at 14:47
    
No. Otherwise, Allow from localhost wouldn’t work either. –  Konrad Rudolph Feb 27 '12 at 14:47
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.