Allow sub range

[EarleyGirl]

I have a range of IPs I'm blocking via .htaccess.

order allow,deny
deny from XX.0.0.0/9
allow from all

I would like to allow a sub range of IPs (such as XX.25.128.0/19) that falls within the range of the ones I'm blocking. Is this possible? From reading some of the Apache module mod_access information, I don't see a way to do this. Would someone here please confirm?

TIA
EG

[jdMorgan]

Yes, it's possible -- In two ways: Either Deny the subranges on either side of the allowed subrange, or Deny the entire range, and then Allow the subrange within it.

Note that the "Order" directive has nothing to do with what order the Deny and Allow directives are listed in your file. Rather, it controls the order that Deny and Allow directives are processed, regardless of their order in your file.

In other words, "Order" sets the priority of Allow and Deny. So, you can have Allows override Denys, or have Denys override Allows, depending on the Order you specify.

Read the documentation for the Order directive very carefully, watching out for the use of the words "AND" and "OR", and choose based upon which method described above you decide to use.

Beware of one small gotcha -- You may use only one Order directive in .htaccess, unless they are contained in mutually-exclusive <Files> or <Limit> containers. In the absence of mutually-exclusive containers, the last Order directive in the file wins, and is the only one used.

Jim