Forum Discussion
Snl
Cirrostratus
Feb 25, 2018Asm geo location irule
folks ,
need some help with asm geo location irule
I want to allow Ip address which contain country SG in forwarder Header , since i have only restricted my ASM geo location policy to allow only ...
JG
Cumulonimbus
Feb 26, 2018when ASM_REQUEST_DONE {
set xff_is_sg ""
if { [whereis [IP::client_addr] country] ne "SG" } {
if { [HTTP::header exists "X-Forwarded-For"] } {
foreach xff [split [string map [list " " ""] [HTTP::header "X-Forwarded-For"]] ","] {
log local0. "Current XFF element: $xff"
Check if the current XFF IP is in SG:
if { [whereis $xff country] eq "SG" } {
log local0. "$xff is from SG."
set xff_is_sg 1
break
}
}
if { $xff_is_sg ne "" } {
ASM::unblock
return
}
}
}
}
However, XFF can be spoofed. If you know which non-SG ip address range your users are forwarded from, then you can tighten up the rule by trusting that range only when processing XFF.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
