I did try that, using the FQDN and the internal LAN address. It broke stuff. I think, however, you're talking about multiple daemons, which I can't do really due to lack of multiple external IP addresses.

I did try multiple virtualhosts inside the 000-sites-enabled.conf:

In this case, it's not possible due to serving on *:443 and *:80, which overrides any FQDN:PORT virtualhost instance later on in the config. Ordinarily I'd do it on :80 and not open that to the world, but the way the system is set up here, some things need to see an HTTP address to know they're authorized to do their work, as well as receiving codes every now and then. I know that's not the best way to do it these days, but when you work with legacy shit that's the way it is. I don't care that you might see "FQDN/docuroot/enterprise/transporterroom/button/code/YJ8MOP998S1

The original thing I tried worked, that of a "require ip 1.2.3.4" directive, but if you tried to access that directory outside of the LAN it gave Apache's Forbidden screen, which I don't want. Since you can't serve anything, even an error page, when you're forbidden, it didn't do what I needed.

What I really need to dig into is to see if there's an IF methodology. I know there's some basic logic Apache can do, but I haven't reached that stage yet.

Kind of but not really. That's good if you're taking an an entire site down and only want a few IP addresses through, I need to let the Internet at large through to the main site while blocking it to the local site. It works with a simple require ip directive, but there doesn't appear to be a way to let that directive work AND let the error handlers work because the error handlers are blocked by the require directive. The reason I want an error handler is simple obscurity - it takes a bit more work to determine if there's a site there, and casual script kiddies will probably ignore it. Otherwise, you get the apache Forbidden screen, and that's a tipoff there's something there you're not supposed to see.

I think I have a solution, although it's not as elegant. There's another server that is accessed with a port number, but there's nothing on the *:80 service. I can put it there, but users won't be able to go to "https://example.com/internalsite", they'll have to go to "http://192.168.1.100" instead. It works, I guess.

That doesn't work because deny all with the require ip directive denies everything, including error pages. I found the solution which required an .htaccess file, which is read before the 000-default is processed. It's posted in another conversation under this topic.