From Apache 2.4 you have the option to use the
RequireAll grouping Directive:
Require ip 192.168.1
Without that explicit
RequireAll directive Apache uses an implicit
RequireAny where successfully matching only one of requirements is sufficient to be granted access.
In Apache 2.2 you had less granular control but could have used the
Satisfy directive to instruct Apache on how the Allow and Require directives should be combined.
Allow from 192.168.1
This requires both an authenticated user and the client IP-address from your local range: in this example