Our arcgis server just got updated to 10.1. All the configurations are done and it is now running properly. But we still need to restrict explicit access to the REST services and only localhost(127.0.0.1) to have access to the REST services.
We have done it in 9.3 by adding an allow entry for localhost on the ArcGIS web app in IIS under the IP Address and Domain Restrictions. Also we set the Feature settings to deny all unspecified clients.
We did the same thing to 10.1 but we can still make explicit calls to the arcgis REST services through other PC.