Blocking of IP in .htaccess not working

Question

I try to configure a simple block of an IP address in my .htaccess. I followed examples I found here in this forum, that seemed to work fine for other users, but do not work for me and I really don't get why.

My .htaccess file is very simple:

Order Allow,Deny
Allow from all
Deny from aaa.bbb.ccc.ddd

I expect that the configured IP address (aaa.bbb.ccc.ddd) will be blocked. But unfortunately it is not blocked.

If I set 'Deny from all' in the third line of my .htaccess, all access is blocked as expected.

So it seems the directive is read by Apache but if I set anything else but 'from all' i. e. a host name or an IP or an IP wildcard etc. no blocking happens.

I appreciate any help, pointing me in the right direction.

Thanks Nestor

Answer 1

After some search I found because of all clients first allowed and then goes to be denied htaccess not work correctly.I reverse deny and allow in .htaccess But finally Solved in this way :

Order Allow,Deny
Deny from aaa.bbb.ccc.ddd

Following ip forbidden 403 and others allowed for browsing. (No Directory tag needed if .htaccess is in current direcotry)

Hope to be helpful

Answer 2

Probably a red herring, but I presume you have the tags around your .htaccess block? eg

<Limit GET POST>
  order allow,deny
  allow from all
  deny from 100.101.102.103
</Limit>

This is how I use it on one of my sites.

Answer 3

Are you sure that the ip address you are including is the ip address that Apache is seeing? If the server is behind a load balancer, it will see the load balancer address.

To overcome this, you need to examine the X-Forwarded-For header

        SetEnvIf X-Forwarded-For ^aaa\.bbb\.ccc\.ddd proxy_env
        Order allow,deny
        Satisfy Any
        deny from env=proxy_env

You can obviously check what ip address is being seen by looking at your logs

Answer 4

I came accross a similar issue recently, this was all about IPv4 and IPv6. Have a look at your server's access logs, and check how your IP address is logged. You might actually be blocking an IPv4 address, while reaching your web server with your IPv6 address (which is not blocked).

If you don't have access to these logs, just try to block your IPv6 the same way you're trying to block your IPv4. You can find your IPv6 here : http://whatismyv6.com/

Order Allow, Deny
Allow From All
Deny From [Your-IPv4]
Deny From [Your-IPv6]

Answer 5

I had the same issue then found that the .htaccess file had mixed new-line characters (CR and some CRLF). deleted the file and created it again with the proper carriage returns