Forum Discussion

MaxMedov's avatar
Icon for Cirrostratus rankCirrostratus
Apr 18, 2023

Block specific Client IP if request contains XYZ

Hi, I need help creating the fastest solution (LTM Policy / iRule / other) to do this:
If client IP = X.X.X.X
and request contains = XYZ
Drop the client / or block by WAF message

Thank you!

7 Replies


    For a very quick solution to match on a single source IP and URI, you could use the following:

    when HTTP_REQUEST {
        if { ( ( [IP::addr [IP::client_addr] equals X.X.X.X] ) && ( [string tolower [HTTP::uri]] contains "xyz" ) ) } {

    However, if you need need it to be more scalable, I would probably use a data group to hold multiple client IP addresses and then maybe another data group or switch -glob statement to match on multiple URIs.

    • CA_Valli's avatar
      Icon for MVP rankMVP

      I'd just advise to avoid using "string tolower" on HTTP uri instruction, since path is case sensitive.