Why is my Apache require by IP not working for a subdirectory?

I want the index page of example.com to be public and the /col directory to be restricted. The IP shown is what appears in my apache log file so I know it's my IP.

<Directory /var/www/example.com/>        Options Indexes FollowSymLinks        AllowOverride None        Require all granted</Directory><Directory /var/www/example.com/col/>        Options Indexes FollowSymLinks        AllowOverride None        Require ip 25.3.213.123</Directory>

I tried multiple apache2 restarts and tested access to both URLs. I was expecting the root URL to be available and the subdirectory not.

I got either full access to both or error 403 for both. Seemed like a cacheing problem?