So I have an Apache running on OSX Server 10.4 (don't ask) with multiple sites. In 0002_[example.com].conf, I have this bit of code:

<Directory "/Library/WebServer/Documents/secret/">
    RewriteEngine On
    RewriteCond %{REMOTE_ADDR} !^137\.250\.
    RewriteRule .* /messages/secret.html
</Directory>

However, in this configuration, the RewriteCond always seems to evaluate to false, since the secret directory gets shown even if the client's address does not begin with 137.250.

If I change the config to this

<Directory "/Library/WebServer/Documents/secret/">
    RewriteEngine On
    RewriteRule .* /messages/secret.html
    RewriteCond %{REMOTE_ADDR} !^137\.250\.
</Directory>

the condition either does not get evaluated at all or always evaluates to true. Either way, all clients get blocked.

What am I doing wrong?