since apache version >= 2.4 directive

Order allow,deny
allow from all

leads to a global 403, to ensure this if you check you're apache's log :

[Tue May 05 11:54:32.471679 2015] [authz_core:error] [pid 9497] [client 127.0.0.1:35908] AH01630: client denied by server configuration: /path/to/web/

Comment Directive Order and add Require all granted like bellow:

 Require all granted
 #Order allow,deny
 #allow from all

Hope this help.

Since apache version >= 2.4 directive

Order allow,deny
allow from all

leads to a global 403, to ensure this if you check you're apache's log :

[Tue May 05 11:54:32.471679 2015] [authz_core:error] [pid 9497] [client 127.0.0.1:35908] AH01630: client denied by server configuration: /path/to/web/

Comment Directive Order and add Require all granted like bellow:

 Require all granted
 #Order allow,deny
 #allow from all

Hope this help.

Edit :

explanation from apache This behaviour is provided by new module mod_authz_host

For list of restriction available (ip, host, etc) http://httpd.apache.org/docs/2.4/en/mod/mod_authz_host.html