Based on the 2 specific string in the URL allow , then restrict ony few incoming IP addresses.

when HTTP_REQUEST {

  set HOST_NAME "webserver.local"
  set NO_IP_RESTRICTION_PATH "/app1"
  set IP_RESTRICTED_PATH "/app2"
  set DEBUG 1

  if { $DEBUG } { log local0. "DEBUG: [HTTP::host] [HTTP::path] [IP::client_addr]" }    
  if { [HTTP::host] == $HOST_NAME } {
    if { ! ([HTTP::path] starts_with $NO_IP_RESTRICTION_PATH) } {
      if { [HTTP::path] starts_with $IP_RESTRICTED_PATH } {
        set clientip [IP::client_addr]
        if { ! ([class match $clientip equals FOX_SALESFORCE_SUBNETS]) } {
          reject
        }         
      }
    }              
  }
}