Combine Apache's HTTP authentication with X-Forwarded-For IP whitelisting in a reverse proxy Loadbalancer

.htaccess

Require all denied

AuthName "Restricted Area"
AuthType Basic
AuthBasicProvider file
AuthUserFile /path/to/your/.htpasswd

Require valid-user

# Normal whitelist would just add Allow directives
Require ip 12.34.56.7
Require ip 12.34.56.8

# Allow from an IP in the X-Forwarded-For header
SetEnvIF X-Forwarded-For "12.34.56.7" AllowIP
SetEnvIF X-Forwarded-For "12.34.56.8" AllowIP
Require env AllowIP

# ...