The Deny directive affects which hosts can access a given directory. Host is one of the following:
all
all hosts are denied access
A (partial) domain-name
host whose name is, or ends in, this string are denied access.
A full IP address
An IP address of a host denied access
A partial IP address
The first 1 to 3 bytes of an IP address, for subnet restriction.
A network/netmask pair (Apache 1.3 and later)
A network a.b.c.d, and a netmask w.x.y.z. For more fine-grained subnet restriction. (i.e., 10.1.0.0/255.255.0.0)
A network/nnn CIDR specification (Apache 1.3 and later)
Similar to the previous case, except the netmask consists of nnn high-order 1 bits. (i.e., 10.1.0.0/16 is the same as 10.1.0.0/255.255.0.0)