For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mohamedabogamil's avatar
Mohamedabogamil
Icon for Nimbostratus rankNimbostratus
Nov 02, 2023
Solved

allow one url from blocks geolocation

i have published service from waf and i block urls on  all country except KSA and i have one url allowed from aruba i used below i rule but its didn't work

hen HTTP_REQUEST {
if { ([string tolower [HTTP::uri]] eq "GET /Arabic/MediaCenter/News/Pages/Infectious-Disease-Week.aspx HTTP/1.1") and ([whereis [IP::client_addr] country] ne " Sweden") } {
ASM::unblock
} else {
return
}
}

application delivery
event
security
unblock

4 Replies

  • Niels_van_Sluis's avatar
    Niels_van_Sluis
    Icon for MVP rankMVP
    Nov 02, 2023

    It seems your first if statement is wrong, because it lowers all strings in [HTTP::uri] and then it is compared to a string which includes uppercase characters. So there will never be a match. Second, the '[whereis ip country]" command returns a string containing the two-letter country code. So it will not match 'Sweden'.  And the ASM::unblock command can't be used in the HTTP_REQUEST event.

    See:

    So, your iRule should be more like:

    when ASM_REQUEST_DONE {
    if { ([string tolower [HTTP::uri]] eq [string tolower "/Arabic/MediaCenter/News/Pages/Infectious-Disease-Week.aspx"]) and ([whereis [IP::client_addr] country] ne "SE") } {
        ASM::unblock
        log local0. "[ASM::violation_data]. Unblocked for [IP::client_addr]"
    } else {
        return
    }
}