iRule to verify request to VIP came via a URL, not an IP

Yes. Something like this might work. Haven't tested it, but the theory is workable I believe.

Data group of allowed DNS hosts used to verify web address. ltm data-group internal /Common/ALLOWEDDNS { records { www.mycompany.com { } www.mycompany.net { } www.mycompany.org { } } type string }

iRule ltm rule /Common/RULE_NOIPS { when HTTP_REQUEST { if {[matchclass [HTTP::host] equals $::ALLOWEDDNS]} { pool MYWEBPOOL } else { reject } } }