цитата из мана по Apache:
Apache
A (partial) domain-name
Example: Allow from apache.org
Hosts whose names match, or end in, this string are allowed access. Only complete components are matched, so the above example will match foo.apache.org but it will not match fooapache.org. This configuration will cause the server to perform a reverse DNS lookup on the client IP address, regardless of the setting of the HostNameLookups directive.
A full IP address
Example: Allow from 10.1.2.3
An IP address of a host allowed access
A partial IP address
Example: Allow from 10.1
The first 1 to 3 bytes of an IP address, for subnet restriction.
A network/netmask pair
Example: Allow from 10.1.0.0/255.255.0.0
A network a.b.c.d, and a netmask w.x.y.z. For more fine-grained subnet restriction. (Apache 1.3 and later)
network/nnn CIDR specification
Example: Allow from 10.1.0.0/16
Similar to the previous case, except the netmask consists of nnn high-order 1 bits. (Apache 1.3 and later)
для deny тоже самое