Your standard .htaccess file might look like this:
AuthUserFile /path/to/.htpasswd AuthName "Restricted Access Area" AuthType Basic Require valid-userThat requires authentication for anyone that accesses that spot on the server.
AuthUserFile /path/to/.htpasswd AuthName "Restricted Access Area" AuthType Basic Require valid-user Order Deny,Allow Deny from all Allow from 192.168.0.0/16 Satisfy AnyThe line 'Satisfy Any' is what makes it work. Although this is documented at The Apache webserver documentation, it's not easy to find for many of us. 'Satisfy Any' means that any of both client authenticators cause the client to be accepted, while 'Satisfy All' would mean all the authenticators have to pass before the client is accepted.