Deny from all folders except /index.php and two folders - apache

Question

This is an odd configuration, I'll give you that, but I'm looking to deny access to all folders in our system but it must be able to access,
/index.php (Wordpress bootloader)
/wp-*/* (e.g. wp-content, wp-admin, etc.)
/templates/* (some of our templates and custom content)
Everything else is denied (and there are hundreds of folders).
The problem I have is allowing index.php and 2 folders and then denying everything else inside /.
I should be able to accept,
http://example.com/
http://example.com/index.php
http://example.com/wp-content/...
http://example.com/wp-admin/...
http://example.com/wp-includes/...
http://example.com/templates/template.css
http://example.com/templates/subfolder/js/file.js
and reject,
http://example.com/thisIsAFolder
http://example.com/thisIsAnotherFolder
This is what I have,
<VirtualHost *:80>
ServerName example.com
DirectoryIndex index.php
DocumentRoot /var/www/
<Directory />
Order deny,allow
Deny from all
</Directory>
<Files index.php>
Allow from all
</Files>
<Directory "/var/www(/|/wp*/|/templates/)">
Allow from all
Options FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) wp/$2 [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ wp/$2 [L]
RewriteRule . index.php [L]
</Directory>
</VirtualHost>
But I continually receive Red Hat Enterprise Linux Test Page (using CentOS) and it allows for sub-directories because I allow /.
EDIT
This is the Apache config that ended up working for me. Big thanks to Jon Lin for the help.
<VirtualHost *:80>
ServerName example.com
DirectoryIndex index.php
DocumentRoot /var/www/
# first, deny all access
<Directory />
Order deny,allow
Deny from all
</Directory>
# then start to allow access where required
<Files index.php>
Allow from all
</Files>
<Directory "/var/www/">
Allow from all
Options FollowSymLinks
RewriteEngine On
RewriteBase /
# go directly to index.php if it is accessed
RewriteRule ^index\.php$ - [L]
# re-write URL for wp-admin access
RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]
# re-write wp-* access to route through wp/
RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) wp/$2 [L]
# re-write all .php files to route through wp/
RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ wp/$2 [L]
# go directly to real files and directories
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
# respond to all other URLs by passing them through index.php
RewriteCond %{REQUEST_FILENAME} !-f [OR]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]
# deny access if URL doesn't start with these
RewriteCond %{REQUEST_URI} !^/(index\.php)?$
RewriteCond %{REQUEST_URI} !^/wp-[^/]+/
RewriteCond %{REQUEST_URI} !^/templates/
RewriteRule ^ - [L,F]
</Directory>
</VirtualHost>

Answer 1

You could try adding:
RewriteCond %{REQUEST_URI} !^/(index\.php)?$
RewriteCond %{REQUEST_URI} !^/wp-[^/]+/
RewriteCond %{REQUEST_URI} !^/templates/
RewriteRule ^ - [L,F]
right before:
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
The problem here though, is that permalinks will probably break, because a request like: /posts/post-title/ will not match an of the "allowed" URI's. If that's a problem, then move it to right before this line:
RewriteRule . index.php [L]