Based on the 2 specific string in the URL allow , then restrict ony few incoming IP addresses.

simple solution...

create a single irule which checks the context [HTTP::uri] == "/abc" or "/123" (app uri, e.g. /abc, or /123) for each case.

for case1 where no IP restriction is required, just route to pool for that app.

for case2, put the retricted src_ips in a datagroup, then after checking for that uri in http request, check for the src_ip via datagroup, if not there, reject, otherwise route to pool for that app.

I can provide an example irule if required, let me know.

thx

Thank youfor that much appreciated. Yes please an example would be nice. that is where I was struggling.

Thanks.

first create datagroup with whatever name you want (e.g. APPNAME_ALLOWED_IP) - add the src ips you want in the list to be allowed to access app2 uri.

when HTTP_REQUEST {
  if {$uri starts_with "/wideopenapp" } {
    pool wideopenapp_pool
  }
  if { $uri starts_with "/restrictedapp" } {
    if { [class match [IP::remote_addr] equals APPNAME_ALLOWED_IP] }{
      pool appname_pool_restricted

    }

}
   else does nada
}

}

}

when HTTP_REQUEST {

  set HOST_NAME "webserver.local"
  set NO_IP_RESTRICTION_PATH "/app1"
  set IP_RESTRICTED_PATH "/app2"
  set DEBUG 1

  if { $DEBUG } { log local0. "DEBUG: [HTTP::host] [HTTP::path] [IP::client_addr]" }    
  if { [HTTP::host] == $HOST_NAME } {
    if { ! ([HTTP::path] starts_with $NO_IP_RESTRICTION_PATH) } {
      if { [HTTP::path] starts_with $IP_RESTRICTED_PATH } {
        set clientip [IP::client_addr]
        if { ! ([class match $clientip equals FOX_SALESFORCE_SUBNETS]) } {
          reject
        }         
      }
    }              
  }
}