What about
https://docs.pivotal.io/pivotalcf/adminguide/app-sec-groups.html ?

On Fri, Oct 30, 2015 at 4:21 PM, Carlo Alberto Ferraris <
carlo.ferraris(a)rakuten.com> wrote:

Is there any provision for restricting the source IPs that are allowed to
access a certain application (or route)? Or the only way to do this is to
place a reverse proxy in front of the gorouter?
In case the reverse proxy is the only way to go, would there be interest
to have something like this implemented inside the gorouter itself? (we're
willing to contribute)