Restricting direct access from public IP

If you VIP hosts single domain then use this to whitelist it

when HTTP_REQUEST {
 switch [string tolower [HTTP::host]] {
 "www.domain.com" 
  {
   return
  }
 default { 
   reject
  }
 }
}

If VIP hosts multiple domains/SAN use below to whitelist all

when HTTP_REQUEST {
 switch [string tolower [HTTP::host]] {
 "www.domain1.com" -
 "www.domain2.com" -
 "www.domain3.com" 
 {
   return
  }
 default { 
   reject
  }
 }
}