when using
xip.io, then in your case 10.154.0.18 should resolve to your LB / SSL termination point, which in most configurations is HA Proxy unless you're bringing your own LB like on AWS ELB or F5, etc.
the LB should forward the following request to one of the CF Routers, which will look at the HTTP host header and then reverse proxy the request to one of your app instances.
then the last REST call, which is the /stats endpoint of your app, should show the IP / ports that the router tier would be using. typically, that IP / port is not routable from an outside network. the LB / CF Router tier is there to abstract the actual IP/ports from clients. here's an example.
REQUEST: [2014-10-14T06:43:18-07:00]
GET /v2/apps/81b95a21-166e-40a8-9430-1b3c7c61dde9/stats HTTP/1.1
Accept: application/json
Authorization: [PRIVATE DATA HIDDEN]
Content-Type: application/json
User-Agent: go-cli 6.6.1-7ce596e / darwin
RESPONSE: [2014-10-14T06:43:19-07:00]
HTTP/1.1 200 OK
Content-Length: 334
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Date: Tue, 14 Oct 2014 13:43:18 GMT
Server: nginx
X-Cf-Requestid: d52407d7-19bd-43a2-4b77-732f736f15c6
X-Content-Type-Options: nosniff
X-Vcap-Request-Id: 5c8f00ab-5552-4f72-7dcd-9f5d683518cf::a1e47a1e-b189-423c-b6ea-94c32d023d9d
{"0":{"state":"RUNNING","stats":{"name":"boot-james","uris":["
boot-james.cfapps.io","
somesillyroute.cfapps.io"],"host":"
10.10.81.10","port":
61053,"uptime":491253,"mem_quota":1073741824,"disk_quota":1073741824,"fds_quota":16384,"usage":{"time":"2014-10-14 13:43:18 +0000","cpu":0.000548501051111202,"mem":438861824,"disk":119029760}}}}