Understanding Apache's Allow, Deny, and Order directives
Suppose that you want to add some IP access restrictions to your web
server, and you're using Apache. Apache supports this with its
Deny directives, but how you set them up is not clear. The Apache
documentation confused me on this recently, so I am going to write down
my own version of it.
The first thing to understand about
is that the last rule that matches wins (unlike the more common
'first match wins').
Order sets the order that the two sorts of
rules are checked and thus determines what the 'last' can be. In
turn this leads to how to decide on what to set for
should use 'allow,deny' if you want to selectively deny some sources
and 'deny,allow' if you want to selectively allow only some source.
Thus we get the template for denying bad sources:
Order allow,deny Allow from all Deny from BADIP1 Deny from BADIP2
And the template for selectively allowing some sources:
Order deny,allow Deny from all Allow from 127.0.0.1 Allow from GOODIP1
If you are a firewall person you are now wondering what the default
policy is if there is no explicit match with either an
Deny rule. The answer is that
Order is inconsistent. '
allow,deny' is default-deny; '
Order deny,allow' is default-allow.
This allows you to leave off the boiler-plate '
Allow from all' or
Deny from all', if you are the kind of person who wants to do that. I
don't plan to ever do so; the whole situation is confusing enough as it
is without adding extra things to remember in the name of saving one
Order is 'deny,allow', which means that at least in theory
the simple way to block bad sources is just to start writing
rules without anything else. (I have not tested this.)