XAMPP running on Vista 64 Ultimate dev machine (don't think it matters).

Machine / Browser configuration

• Safari, Firefox, Chrome and IE9 on dev machine
• IE7 and IE8 on separate XP Pro VM's (VMWare on dev machine)
• IE10 and Chrome on Windows 8 VM (VMware on dev machine)
• Safari, Firefox and Chrome running on a iMac (same network as dev)
• Safari, Firefox and Chrome running on a couple of Mac Pro's (same network as dev)
• IE7, IE8, IE9 running on other PC's on the same network as dev machine

Development Configuration

• Multiple virtual hosts for different projects
• .local fake TLD for development
• No firewall restrictions on dev machine for Apache
• Some sites have .htaccess mapping www to non-www
• Port 80 is open in the dev machine's firewall

Problem

• XAMPP local home page (http://192.168.1.98/xampp/) can be accessed from everywhere, real or virtual, by IP
• All .local sites can be accessed from the browsers on the dev machine.
• All .local sites can be accessed form the browsers in the XP VM's.
• Some .local sites cannot be accessed from IE10 or Chrome on the W8 VM
• Sites that cannot be accessed from W8 VM have a minimal .htaccess file
• No .local sites can be accessed from ANY machine (PC or Mac) on the LAN

hosts on dev machine (relevant excerpt)

127.0.0.1  site1.local
127.0.0.1  site2.local
127.0.0.1  site3.local
127.0.0.1  site4.local
127.0.0.1  site5.local
127.0.0.1  site6.local
127.0.0.1  site7.local
127.0.0.1  site8.local
127.0.0.1  site9.local

192.168.1.98  site1.local
192.168.1.98  site2.local
192.168.1.98  site3.local
192.168.1.98  site4.local
192.168.1.98  site5.local
192.168.1.98  site6.local
192.168.1.98  site7.local
192.168.1.98  site8.local
192.168.1.98  site9.local

httpd-vhosts.conf on dev machine (relevant excerpt)

NameVirtualHost *:80

<VirtualHost *:80>
  ServerName localhost
  ServerAlias localhost *.localhost.*
  DocumentRoot D:/xampp/htdocs
</VirtualHost>

# ======================================== site1.local
<VirtualHost *:80>
  ServerName site1.local
  ServerAlias site1.local *.site1.local
  DocumentRoot D:/xampp-sites/site1/public_html
  ErrorLog D:/xampp-sites/site1/logs/access.log
  CustomLog D:/xampp-sites/site1/logs/error.log combined

  <Directory D:/xampp-sites/site1>
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
  </Directory>
</VirtualHost>

NOTE: The above <VirtualHost *:80> block is repeated for each of the nine virtual hosts in the file, no sense in posting it here.

hosts on all VM's and physical machines on the network (relevant excerpt)

127.0.0.1       localhost
::1             localhost

192.168.1.98  site1.local
192.168.1.98  site2.local
192.168.1.98  site3.local
192.168.1.98  site4.local
192.168.1.98  site5.local
192.168.1.98  site6.local
192.168.1.98  site7.local
192.168.1.98  site8.local
192.168.1.98  site9.local

None of the VM's have any firewall blocks on http traffic. They can reach any site on the real Internet. The same is true of the real machines on the network.

The biggest puzzle perhaps is that the W8 VM actually DOES reach some of the virtual hosts. It does NOT reach site2, site6 and site 9, all of which have this minimal .htaccess file.

.htaccess file

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]
</IfModule>

Adding this file to any of the virtual hosts that do work on the W8 VM will break the site (only for W8 VM, not the XP VM's) and require a cache flush on the W8 VM before it will see the site again after deleting the file.

Regardless of whether a .htaccess file exists or not, no machine on the same LAN can access anything other than the XAMPP home page via IP. Even with hosts files on all machines. I can ping any virtual host from any machine on the network and get a response from the correct IP address. I can't see anything in out Netgear router that might prevent one machine from reaching the other. Besides, once the local hosts file resolves to an ip address that's all that goes out onto the local network.

I've gone through an extensive number of posts on both SO and as the result of Google searches. I can't say that I have found anything definitive anywhere.