apm and irule

im have set up an apm solution for a customer, that grants vpn access to a given network. from this network, various remote vendors will access servers to perform their tasks. What i want to achieve, is that the vendors should only reach the servers they are allowed to, and not anything else within the address ranges they have access to.

 

As the customer has standardized, i was thinking that i could write an iRule, that checks if the last octet belongs to the allowed addresses. I have tried some simple irules before, but the execution of the iRule is blocking all access.

 

How can i do a check towards the destination address they will connect to, after apm authentication, and vpn has been established?