For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jlb4350's avatar
jlb4350
Icon for Cirrus rankCirrus
Oct 23, 2023

Block outbound connections via DNS rather than server_connected

I have an iRule that calls on a datagroup to block outbound traffic from my office to certain countries. The iRule is working, but I am using iRule event "server_connected" and when that occurs it just drops the connection. However, I would like to drop this connection before the actual connection to the remote server occurs. The concern being that there is a TCP handshake that occurs with the remote server using this iRule. Is there a way to set this up by using a DNS query or a geolocate function and if the query returns that the server is in one of the countries in the blacklist datagroup, the connection is denied/rejected?

Here is my current iRule with "OutboundBlackList" being the datagroup with the list of blocked countries.

 

when SERVER_CONNECTED {
  if {([class match [whereis [IP::server_addr] country] equals "OutboundBlacklist"])}{
    reject
  }
}

 

Thank you for any help you can provide! 

devops

6 Replies

    • jlb4350's avatar
      jlb4350
      Icon for Cirrus rankCirrus
      Oct 23, 2023

      Interesting. Thank you for that suggestion. So just replace SERVER_CONNECTED with LB_SELECTED in the iRule? Could you elaborate some on what LB_SELECTED does? The page is quite vague about how it works...

      Thanks again for your help.

      • Niels_van_Sluis's avatar
        Niels_van_Sluis
        Icon for MVP rankMVP
        Oct 23, 2023

        In the LB_SELECTED event you can get information about which pool member is selected and take some action on it. In this event you can evaluate the results of LB::server. You can use this to replace IP::server_addr in your current iRule. See the first iRule example in the article below.

        https://clouddocs.f5.com/api/irules/LB__server.html