Virtual Server Destination address

You could use a single "external" (client-facing) virtual server that maps to your public IP address, and then use a local traffic policy on that virtual server to look at the domain name (host name) in the URL and forward the traffic to one of several "internal" virtual servers (on the same BIG-IP system) with private IP addresses. The "external" or main virtual server has no pool associated with it; just the local traffic policy (or iRule) that forwards the traffic to the correct "internal" virtual server based on host name. The "internal" virtual servers can each have their own protections, and load balance to their respective application pool members.