Deny all, allow only one IP through htaccess

0 votes
asked Dec 9, 2010 by punkbit

I'm trying to deny all and allow only for a single IP. But, I would like to have the following htaccess working for that single IP. I'm not finding a way to have both working: the deny all and allow only one, plus the following options:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    #Removes access to the system folder by users.
    #Additionally this will allow you to create a System.php controller,
    #previously this would not have been possible.
    #'system' can be replaced if you have renamed your system folder.
    RewriteCond %{REQUEST_URI} ^system.*
    RewriteRule ^(.*)$ /index.php?/$1 [L]

    #When your application folder isn't in the system folder
    #This snippet prevents user access to the application folder
    #Submitted by: Fabdrol
    #Rename 'application' to your applications folder name.
    RewriteCond %{REQUEST_URI} ^application.*
    RewriteRule ^(.*)$ /index.php?/$1 [L]

    #Checks to see if the user is attempting to access a valid file,
    #such as an image or css document, if this isn't true it sends the
    #request to index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ index.php?/$1 [L]
</IfModule>

<IfModule !mod_rewrite.c>
    # If we don't have mod_rewrite installed, all 404's
    # can be sent to index.php, and everything works as normal.
    # Submitted by: ElliotHaughin

    ErrorDocument 404 /index.php
</IfModule>

Is there a way to make this work?

9 Answers

0 votes
answered Dec 9, 2010 by b101101011011011
order deny,allow
deny from all
allow from <your ip> 
0 votes
answered Dec 18, 2012 by oliver-maksimovic

Slightly modified version of the above, including a custom page to be displayed to those who get denied access:

ErrorDocument 403 /specific_page.html
order deny,allow
deny from all
allow from 111.222.333.444

...and that way those requests not coming from 111.222.333.444 will see specific_page.html

(posting this as comment looked terrible because new lines get lost)

0 votes
answered Dec 18, 2012 by mickeyroush

This can be improved by using the directive designed for that task.

ErrorDocument 403 /specific_page.html
Order Allow,Deny
Allow from 111.222.333.444

Where 111.222.333.444 is your static IP address.

When using the "Order Allow,Deny" directive the requests must match either Allow or Deny, if neither is met, the request is denied.

http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order

0 votes
answered Dec 1, 2016 by david-brown

I know this question already has an accepted answer, but the Apache documentation says:

The Allow, Deny, and Order directives, provided by mod_access_compat, are deprecated and will go away in a future version. You should avoid using them, and avoid outdated tutorials recommending their use.

So, a more future-proof answer would be:

<RequireAll>
    Require ip xx.xx.xx.xx yy.yy.yy.yy
</RequireAll>

Hopefully, I've helped prevent this page from becoming one of those "outdated tutorials". :)

0 votes
answered Dec 2, 2016 by ivanrf

Improving a bit more the previous answers:

ErrorDocument 403 /maintenance.html
Order Allow,Deny
Allow from #.#.#.#

Where:

0 votes
answered Dec 20, 2016 by starkeen

You can use the following in htaccess to allow and deny access to your site :

SetEnvIf remote_addr ^1\.2\3\.4\.5$ allowedip=1

Order deny,allow
deny from all
allow from env=allowedip

We first set an env variable allowedip if the client ip address matches the pattern, if the pattern matches then env variable allowedip is assigned the value 1 .

In the next step, we use Allow,deny directives to allow and deny access to the site. Order deny,allow represents the order of deny and allow . deny from all this line tells the server to deny everyone. the last line allow from env=allowedip allows access to a single ip address we set the env variable for.

Replace 1\.2\.3\.4\.5 with your allowed ip address.

Refrences :

0 votes
answered Sep 15, 2017 by meloman

You can have more than one IP or even some other kind of allow like user, hostname, ... more info here https://www.askapache.com/htaccess/setenvif/

SetEnvIf remote_addr ^123.123.123.1$ allowedip=1
SetEnvIf remote_addr ^123.123.123.2$ allowedip=1
SetEnvIf remote_addr ^123.123.123.3$ allowedip=1
SetEnvIf remote_addr ^123.123.123.4$ allowedip=1

Order deny,allow
deny from all
allow from env=allowedip
0 votes
answered Sep 15, 2017 by metalfury

I wasn't able to use the 403 method because I wanted the maintenance page and page images in a sub folder on my server, so used the following approach to redirect to a 'maintenance page' for everyone but a single IP*

RewriteEngine on
RewriteCond %{REMOTE_ADDR} !**.**.**.*
RewriteRule !^maintenance/ http://www.website.co.uk/maintenance/ [R=302,L]

Source: Creating a holding page to hide your WordPress blog

0 votes
answered Sep 15, 2017 by abhishek-gurjar

If you want to use mod_rewrite for access control you can use condition like user agent, http referrer, remote addr etc.

Example

RewriteCond %{REMOTE_ADDR} !=*.*.*.* #you ip address
RewriteRule ^$ - [F]

Refrences:

Welcome to Q&A, where you can ask questions and receive answers from other members of the community.
Website Online Counter

...