Forum Discussion
Allow traffic from specific IP to Specific URI
On our website we want to allow only few IPs on a specific URI. I write below iRULE, it is blocking all the traffic to go to that URI instead of the one I define in Pool. Thank you for help in advance.
when HTTP_REQUEST { if { [HTTP::uri] contains "/abc/xyzServlet" and (not [matchclass[IP::remote_addr] equals $::AddressAllowedPool ]) } { reject } else { pool Pool_servers } }
8 Replies
- What_Lies_Bene1
Cirrostratus
Try this, where AddressAllowedPool is the Data Group;
when HTTP_REQUEST { if { [HTTP::uri] contains "/abc/xyzServlet" and (not [class match [IP::addr [IP::client_addr] equals AddressAllowedPool ]) } { reject } else { pool Pool_servers } } - Kevin_Stewart
Employee
We'll have to assume then that you're running a 9.x F5 version. The class command was introduced in v10.0.
So try this:
when HTTP_REQUEST { if { ( [HTTP::uri] contains "/abc/xyzServlet" ) and not ( [matchclass [IP::client_addr] equals AddressAllowedPool ] ) } { reject } else { pool Pool_servers } } - Amit_Shah_6642
Nimbostratus
It was not working because I was behind NAT. The server was looking at only one NAT IP address.
- What_Lies_Bene1
Cirrostratus
OK, so working now?
- Amit_Shah_6642
Nimbostratus
yes, after I added NAT IP address to AddressAllowedPool.
- What_Lies_Bene1
Cirrostratus
OK, cool. You probably don't need the DG at all I guess.
- Amit_Shah_6642
Nimbostratus
I need it to protect from outside users. This website is hosted on server is in the DMZ. I will create a Static NAT for Inside address to be allowed to this host on Firewall between Inside and DMZ network. I will add Static NAT address to DG. Thank you for your help! I really appreciate your time and help.
- What_Lies_Bene1
Cirrostratus
You're welcome. Any issues, post back. Cheers
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com