login page of the Oracle Apex admin

If I understand your question correctly, then this is what you want: An application with no authentication for its pages, but when a user clicks on "Administration" a login screen is shown and user needs to authenticate.

Here is how to create such an application from scratch. In my case I'm creating an empty application (only a home page) with no authentication required and a link to "Administration" that does require login. Test is done on apex 22.1 but this should work on all versions.

• Create new application using application wizard. Check the "Features" section so the "Administration" pages are created. No need to add any pages since by default a home page is created. Click "Create Application"

• Shared Components > Application Definition > Security. Set "Authorization Scheme" to "no application authorisation required".

• Page 1 > Page properties > Security > Authentication > "Page is public". Now when a user accesses the application he will not be prompted for login. Note that when you run the application, there will be no menu option for the "Administration" section. That is because the navigation menu entry for "Administration" has an authorization scheme set.

• Shared Components > Lists > Navigation Menu. Edit the "Administration" entry. Set "Authorization" to "No Authorization Required".

Now run the page. You'll see you're not prompted for a login on page 1 and the "Administration" link is visible. When clicking on "Administration" a login screen is shown.

You can restrict access to APEX in general by IP address (see documentation: https://docs.oracle.com/en/database/oracle/application-express/21.2/aeadm/configuring-service-level-security-settings.html#GUID-1952AB59-7DC5-48C3-B4A5-31398CEA1485), but not to the Internal/Admin login page specifically.

To restrict access to a specific, otherwise publicly available page within APEX you'd need to place an IP filter on a reverse HTTP proxy or load balancer in front of APEX, then limit APEX to receiving connections only from that proxy. The problem with that arrangement is that most systems can't determine who a user is or what their role is (management vs user) based solely on their network address.

The pretty much universal use of DHCP to provide network addresses for client systems means that addresses aren't constant or associated with a specific person, and most people wouldn't want to limit access to a specific workstation anyway: your requirement was identity-based, not address-based. The best you could do with a reverse-proxy network restriction would likely be to limit connections to the login page to your internal company network, and even that might not be practical depending on your situation.

All of that is a very round-about way of saying no: there is no practical identity-based way for most systems to limit access to a public login page, because the user's identity can't be established until after they login. The best you can do would be to use a reverse proxy or load balancer to place a blanket, network-based restriction on the login page.