Apps Artificial Intelligence CSS DevOps Go JavaScript Laravel Linux MongoDB MySQL PHP Python Rust Svelte Vue

How to Block IP Ranges with `.htaccess`

1 min read .
Updated on
How to Block IP Ranges with `.htaccess`

One useful feature of Apache is the flexibility of .htaccess. In addition to URL rewriting and caching rules, .htaccess can also restrict access based on IP addresses.

If you are dealing with spam bots, brute-force attempts, or unwanted traffic from a particular network, one quick option is to block an individual IP address or an entire range.

Block a Single IP Address

To block one IP address, use:

<RequireAll>
  Require all granted
  Require not ip 192.168.1.100
</RequireAll>

This blocks 192.168.1.100 while allowing other clients to access the site.

Block an IP Range

To block a complete range such as 192.168.1.0 through 192.168.1.255, use CIDR notation:

<RequireAll>
  Require all granted
  Require not ip 192.168.1.0/24
</RequireAll>
  • /24 corresponds to the subnet mask 255.255.255.0, covering 256 IPv4 addresses.
  • This rule blocks every address from 192.168.1.0 through 192.168.1.255.

Practical Examples

  • Block a larger range:

    <RequireAll>
  Require all granted
  Require not ip 10.0.0.0/16
</RequireAll>

    This blocks 10.0.0.0 through 10.0.255.255.

  • Block several addresses or subnets:

    <RequireAll>
  Require all granted
  Require not ip 203.0.113.25
  Require not ip 198.51.100.0/24
  Require not ip 192.0.2.0/28
</RequireAll>

  • Allow only specific addresses instead:

    <RequireAny>
  Require ip 203.0.113.5
  Require ip 203.0.113.6
</RequireAny>

    Every address not listed is denied.

Important Notes

  1. Apache version → The Require syntax applies to Apache 2.4+. Apache 2.2 used the older Deny from and Allow from directives.
  2. Avoid extremely large rule sets → .htaccess is processed during requests. If you need to block thousands of addresses, a firewall such as iptables, nftables, or ufw, or a WAF, is usually a better fit.
  3. Test before production → A mistake in an access rule can lock out legitimate users or administrators, so validate the configuration before deploying it broadly.

Conclusion

Blocking individual IP addresses or CIDR ranges with .htaccess is a convenient way to stop unwanted traffic at the Apache layer. It works well for small to medium rule sets, while larger-scale filtering is better handled by a firewall or Web Application Firewall (WAF).

DevOps Apache Htaccess Security

Related Posts

.htaccess Rules to Prevent PHP Execution
Published on
.htaccess Rules to Prevent PHP Execution
Public upload directories are a common security-sensitive part of web applications. If an attacker manages to upload a file such as shell.php and the web server executes it, the upload feature can become a route to remote code execution. On Apache, a directory-specific .htaccess configuration can help prevent script execution in locations that should contain only static files. Why .htaccess Can Help Apache supports .htaccess files for directory-level configuration when the server permits the relevant overrides. This makes it possible to apply security rules to a specific directory without changing every virtual-host setting.
DevOps Security Apache htaccess
How to Whitelist IP Address Ranges with .htaccess
Updated on
How to Whitelist IP Address Ranges with .htaccess
.htaccess is useful for more than URL rewriting and caching. It can also provide an additional access-control layer, including restricting an application to specific IP addresses or IP ranges. This technique can be useful when: An application is still in development and should only be available to an internal team. You want to protect sensitive paths such as /admin or /api. A server should only be reachable from an office network or VPN. Whitelist One IP Address To allow only one IP address:
DevOps Security Apache htaccess
Automatically Encrypting Eloquent Model Attributes
Published on
Automatically Encrypting Eloquent Model Attributes
Applications often store fields that deserve additional protection at rest. Laravel can encrypt selected Eloquent attributes before they are written to the database and decrypt them automatically when they are read. For modern Laravel applications, the built-in encrypted cast is preferable to overriding Eloquent’s magic __get() and __set() methods. It integrates with the model casting system and avoids interfering with Eloquent internals. Basic Implementation Define encrypted attributes in the model’s casts:
Laravel Security Encryption
Creating a CA Bundle and Converting an SSL Certificate to .PFX
Published on
Creating a CA Bundle and Converting an SSL Certificate to .PFX
Managing SSL/TLS certificates is a routine task for many developers and system administrators. One common requirement is to combine intermediate certificates into a CA bundle and then convert the certificate and private key into a .pfx file. The .pfx format, also known as PKCS#12, is commonly used when importing certificates into Windows Server and IIS, Microsoft Exchange, and other applications that expect a PKCS#12 bundle. This guide walks through the process.
DevOps SSL
Using Nginx as a Reverse Proxy for a Go Application
Updated on
Using Nginx as a Reverse Proxy for a Go Application
A Go web application often listens directly on an application port such as :8080. If you want users to access it through a normal domain on port 80 or 443, you can place Nginx in front of it as a reverse proxy. Using Nginx in front of a Go service provides several benefits: Client requests reach Nginx before being forwarded to the Go application. TLS termination can be handled at the proxy layer. Multiple application instances can be load balanced. Static assets can be served separately when that architecture makes sense. This guide shows a basic setup.
DevOps Golang Linux Nginx Reverse Proxy
chevron-up