How to allow user to Remote Desktop to server on their subnet that they are belong to?

I configured the webtop to allow users to enter their Remote Desktop Connection IP address to AWS EC2 instance. Next, I want to only allow specific groups to have access on their AWS VPC subnet. We managed multiple AWS VPC for different program groups.

 

Right now, user can enter IP address for RDP that belong to another program VPC subnet.

 

For example: User (from Program1) should only RDP to any servers on their subnet 10.0.1.0/24, but they can still RDP to any servers to another Program subnet. I need to find a way for Program1 only have RDP access to their subnet 10.0.1.0/24 not other subnet.

 

I tried using ACLs, but the problem is that Remote Desktop object on F5 is part of ACL and I’m using variable: %{session.logon.last.ipaddress}:3389 which will allow any IP address. It will never go to the next ACL in order. See picture:

 

 

Any idea how I can do this?