IP filter

[three]

I added an .htaccess file to filtter IP addresses, and it doesn't seem to be working. It's denying access to everybody.[nbsp][nbsp]here is a sample of the code i used- and it lists about 150 ip's.[nbsp][nbsp]Can anybody help me troubleshoot? or can you see anything that I did wrong?

<Limit GET POST>
order allow,deny
deny from all
allow from 128.94.
allow from v130.143.
allow from 135.1.
allow from 135.2.
allow from 135.3.
allow from 135.4.
allow from 135.5.
allow from 135.6.
allow from 198.152.
allow from 198.206.19
allow from 198.207.16
</Limit>

[Terra]

Unless you really need to restrict the 'METHODS', I would drop the '<Limit>...</Limit>' container...

Also I recommend changing:
allow from v130.143.
to
allow from 130.143

This particular one has a syntax error, but also note that you do not need the 'trailing' period as you are matching octets...

--
Terra
--As if the 'trailing' slash wasn't problem enough-- :P
FutureQuest

[three]

Oops! der.... i should've caught the typo.[nbsp][nbsp]I'll try it without the typo.[nbsp][nbsp]One thing though, you said i don't need the trailing period?[nbsp][nbsp]do you mean i don't need the period to end each range?[nbsp][nbsp]I was told that I do - should I try it without the period on all of the ip ranges? or just specific ones?[nbsp][nbsp]
thanks for your help

[Terra]

My suggestion is reduce your test set to the *bare minimum*...

Use something you *know* will fail, and test that
then use something you *know* will pass...

Do each one step-by-step, then gradually add more and test again...

Doing too much at once will almost always obfuscate the underlying problem...

I believe with Apache, either way _should_ work, but I always omit the trailing '.' and it works for me...

--
Terra
--Process of addition--
FutureQuest

[Justin]

I've always heard that it's best to leave the dot because it is doing a string comparison, and without the dot, something like this:

deny 1.2.3

Will also deny 1.2.34.2 - where the dot shows that it is the end of that octed and a string comparison on the above IP would not be matched... So it would be roughly:

/^1.2.3/

Which is not what you want to match (discounting the unescaped dots)...

Hope that made sense...

<edit reason=&quot;oops&quot; excuse=&quot;3am&quot;>
&quot;octet&quot; !~ /d/
</edit>

------------------
Justin Nelson
FutureQuest (http://www.FutureQuest.net/index.php) Support
[This message has been edited by Justin (edited 02-08-00@02:53 am)]