restrict public access

when HTTP_REQUEST {
   if { [string tolower [HTTP::uri]] starts_with "/prod" and ![IP::addr [IP::client_add] equals 10.233.0.0/16] } {
      discard } }

That will check if the URI starts with prod. If it starts with prod and the user's IP isn't in the 10.233.0.0/16 network, it'll discard the request.

Is that what you wanted? Like Michael, I also like to use data groups here for scalability but if this is all you need, perhaps it'll suffice.