That did the trick Genard, thank you for finding that. I was able to get the blocking working, and a visual confirmation with a HTTP::redirect. Thanks again for your help.
when HTTP\_REQUEST \{
set URI [HTTP::uri]
if \{ not [IP::addr [IP::client\_addr] equals 192.168.1.0/24] and ($URI starts\_with "/ecp")\} \{
HTTP::redirect “http://example.net/not_authorized.html”
\}
\}
when HTTP\_REQUEST \{
set URI [HTTP::uri]
if \{ not [IP::addr [IP::client\_addr] equals 192.168.1.0/24] and ($URI starts\_with "/ews")\} \{
HTTP::redirect “http://example.net/not_authorized.html”
\}
\}
when HTTP\_REQUEST \{
set URI [HTTP::uri]
if \{ not [IP::addr [IP::client\_addr] equals 192.168.1.0/24] and ($URI starts\_with "/rpc")\} \{
HTTP::redirect “http://example.net/not_authorized.html”
\}
\}