I’m trying to restrict access to a web resource to the intranet of a company via .htaccess. Unfortunately, the approach via Allow from … isn’t working for me and and I don’t understand subnets well enough to troubleshoot the issue.

My IP address is (replaced the first two blocks for privacy), the netmask is given by ifconfig as 0xffff0000, i.e. I’ve used an IP address calculator go get the subnet from this.

An answer on Stack Overflow led me to believe that the following should work:

Order deny,allow
Deny from all
Allow from

Or, using CIDR (only showing the last line):

Allow from

Neither works. Nor does the following work, as implied by answer on this very site:

Allow from 1.2

In fact, not even the following works:

Allow from

But this does work:

Allow from localhost

Although I thought these two to be equivalent. Clearly, I have a gap in my understanding.

For completeness, this is the output of ifconfig | grep inet[^6]:

inet netmask 0xff000000 
inet netmask 0xffff0000 broadcast

What am I doing wrong?

3 Answers 3


The solution was that I accessed the website via localhost/path/to/site rather than Once I changed that, it worked.


First off, are you adding these directives in an .htaccess file or a config file? If the latter, then you need to restart Apache.

Secondly, do you have mod_authz_host enabled? In your httpd.conf, there should be a line like:

LoadModule authz_host_module modules/mod_authz_host.so

Lastly, are you sure it's not working? I.e. are you testing the right path/server? Are you sure a rewrite rule or custom error page isn't making it look like you've gained access to the page even though you're being shown a different page? Also, what's not working? Is it giving access to external IPs or denying access to internal IPs?

Clear your access log (delete the file), restart the server, and test the URL once more; then look at the access log and see what IP address was recorded and what response code was given.

There are other ways of doing it (e.g. via mod_rewrite or SetEnvIf/Allow from env=), but what you're doing should work.

  • 1
    Actually I’m already using SetEnvIf for a different purpose since I only want to restrict access to a single (non-physical) resource and I don’t have write access to the server’s httpd.conf so I cannot use <Location>. Now, the solution of the puzzle is that I was using the wrong IP address to access the server – via localhost rather than my local network. Commented Feb 27, 2012 at 16:14
  • @Konrad: Fairly common mistake. That's why it's always worth the effort to check the access logs. Commented Feb 27, 2012 at 16:17
  • 1
    I’d love to. Unfortunately I don’t have access to it. :-( The server configuration is irking me more and more … Apache 1, PHP 5.0 (full of bugs) … Commented Feb 27, 2012 at 16:26

Try this for the .htaccess file:

order allow,deny
#partial ip addresses blocking
deny from 192.168
deny from 219

#full ip addresses blocking
deny from
deny from
allow from all
  • Actually, I want the opposite – block from everywhere except from a given range. The question is how I specify the range, since my approaches of notating the subnet don’t work. Commented Feb 27, 2012 at 14:36
  • Then do: order deny,allow and do allow from and such. Just switch the allows and deny's
    – ionFish
    Commented Feb 27, 2012 at 14:40
  • But that’s exactly what I’m already doing, and it’s not working. Commented Feb 27, 2012 at 14:45
  • In your httpd.conf, is there a line saying allow-override none, specifically near an IP-restricting code like in my post? If so, change to "allow-override all"
    – ionFish
    Commented Feb 27, 2012 at 14:47
  • No. Otherwise, Allow from localhost wouldn’t work either. Commented Feb 27, 2012 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.