apache 2.4 - deny direct ip access and show custom error page - apache

Question

I want requests to http://example.com to serve my website, and requests to http://123.123.123.123 to show a customized 403 error page.
I have Apache/2.4.29 running on my Ubuntu server.
/etc/apache2/sites-available/vhosts.conf
<VirtualHost *:80>
ServerName default
<Location />
Require all denied
</Location>
</VirtualHost>
<VirtualHost *:80>
ServerName example.com
DocumentRoot /var/www/html
<Directory /var/www/html>
Options None
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
/etc/apache2/conf-available/security.conf
Alias /errors/ "/var/www/html/error-pages/"
ErrorDocument 401 /errors/401.php
ErrorDocument 403 /errors/403.php
ErrorDocument 404 /errors/404.php
ErrorDocument 500 /errors/500.php
<Directory /var/www/html/error-pages>
Require all granted
</Directory>
With the above setup direct-ip access is blocked, however it is not showing my custom error page.
Forbidden You don't have permission to access / on this server.
Additionally, a 403 Forbidden error was encountered while trying to
use an ErrorDocument to handle the request.
Then I tried using the directive instead of :
<VirtualHost *:80>
ServerName default
<Directory />
Require all denied
</Directory>
</VirtualHost>
Now all subdirectories (e.g. http://123.123.123.123/sub) show my error page, but unfortunately the root is not blocked at all and showing my index.php page.
My next guess was to experiment with wilcards:
<VirtualHost *:80>
ServerName default
<Location "/*">
Require all denied
</Location>
<Location "/*/">
Require all denied
</Location>
</VirtualHost>
This code works, and shows my own 403 error page on the root aswell all the subdirectories.
All this got me confused!
Is the how it should be done, or am I doing something wrong in the first two examples?

Answer 1

<VirtualHost _default_:80>
<Directory "${SRVROOT}/htdocs">
Require all denied
</Directory>
ErrorDocument 403 "Sorry, direct IP access not allowed."
ErrorLog "${SRVROOT}/logs/default-http-error.log"
CustomLog "${SRVROOT}/logs/default-http-access.log" combined
</VirtualHost>
This is what I have setup in my server where the directory directive is to denied access to all files in this virtualhost. And the errordocument 403 serving as a message. Other syntax are for error logging. Make sure this virtual host is before any other virtualhost. Something similar for the HTTPS scheme if you support HTTPS on your server.