Access Control Lists: how to enable for subfolders, ie. /wp-admin?

[K1WIZ]

How can I implement an ACL to allow all for / but whitelist only for /wp-admin by IP, IP subnet (CIDR)?

[michmoor0725]

Under Advanced configuration

location /admin {
allow 192.168.1.100; # Replace with your allowed IP address
deny all;
return 403;
}

[TSJasonH]

Did anybody else try this? It doesn't seem to work for me.
Any IP added in the allow returns a 403 regardless. Removing said IP from the allow list then returns a 404.
Removing the stanza and the /admin location works fine (to the world).

[TSJasonH]

So two things:

1. don't add the 'return 403;' as that will in fact return it for any IP regardless of the allows.
2. For proxy hosts it's gotta have an include statement for the proxy configuration

So this works:

location /admin {
  include conf.d/include/proxy.conf;
  allow 192.168.1.100; # Replace with your allowed IP address
  deny all;
}