Forum Discussion

yaxzone_100047's avatar
yaxzone_100047
Icon for Nimbostratus rankNimbostratus
Apr 28, 2010

block request on page type - help

Hi there everyone, At our shop, we would like to setup an iRule that will either deny access or drop request based on a request type. For example, if a request comes in for /*.php we would like the request to not make it to our web servers. We are .net and .cf shop but we get tons of request for .php files. Most of these are bots looking for know exploits and it is overwhelming our web servers. I have inherited the current setup we have and i'm new to irules so any pointers would be greatly appreciated. Thanks.
application delivery
dev
devops
iRules
  • yaxzone_100047's avatar
    yaxzone_100047
    Icon for Nimbostratus rankNimbostratus
    Apr 28, 2010
    Looking at various rules, i've put together the following... Any ideas anyone?

     

     

    when HTTP_REQUEST {

     

    if {[HTTP::uri] contains ".php"]} {

     

    HTTP::redirect "http://www.google.com"

     

    drop

     

    }

     

    }

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Apr 28, 2010
    You could be more specific and check the HTTP path (URI minus the query string): 

    
when HTTP_REQUEST {

    Check for unwanted filetypes
   switch -glob [string tolower [HTTP::path]] {
      "*.php" -
      "*.exe" -
      "*.dll" {
         Reset the TCP connection
         reject
      }
   }
}

    Aaron