Limit public to forwarding only?

[bpmartin20]

This seems very basic, but I haven't been able to find it....

My YOURLS installation sits in the DMZ. I want the intranet side (as determined by IP, perhaps) to be able to create short URLs, but the public side should only be able to follow them. The public side should have no access to any part of YOURLS other than visiting a shortened URL and getting redirected to the long URL.

This would be easy to do in .htaccess amongst other approaches, but if I modify it, I'm afraid an update will remove it.

I saw a suggestion that there might be a plugin for this, but the only plugin I found is no longer maintained. Any advice?

[Decicus]

This would be easy to do in .htaccess amongst other approaches, but if I modify it, I'm afraid an update will remove it.

I do something similar to, by using a .htaccess file in the /admin folder of my YOURLS installation (only difference is that I have HTTP password auth, but it should effectively work the same if you do IP whitelisting).
By default, YOURLS doesn't have an .htaccess file in the admin folder, so it shouldn't be overwritten during any upgrades (assuming you are simply overwriting existing files - and not deleting any - when you do an upgrade).