Blocking a URL except from specific IP addresses

We would like to block access to a specific URL for a web application except if it is coming in from our VPN (known IP address ranges) or from our internal network. ie /admin but allow /user. How shou...