Forum Discussion

MaxMedov's avatar
MaxMedov
Icon for Cirrostratus rankCirrostratus
Apr 18, 2023

Block specific Client IP if request contains XYZ

Hi, I need help creating the fastest solution (LTM Policy / iRule / other) to do this: If client IP = X.X.X.X and request contains = XYZ Drop the client / or block by WAF message Thank you! ...
security
CA_Valli's avatar
CA_Valli
Icon for MVP rankMVP
Apr 18, 2023

I'd just advise to avoid using "string tolower" on HTTP uri instruction, since path is case sensitive. 

MaxMedov's avatar
MaxMedov
Icon for Cirrostratus rankCirrostratus
Apr 18, 2023

So what is better?

  • CA_Valli's avatar
    CA_Valli
    Icon for MVP rankMVP
    Apr 18, 2023

    [HTTP::path] or [HTTP::query] should work just fine for exact matches on path/query parts of the uri 

  • Michael_Saleem's avatar
    Michael_Saleem
    Icon for MVP rankMVP
    Apr 18, 2023

    If you are using a mixture of upper and lowercase letters in your URI and you need an exact match on this, then remove the [string tolower]

    when HTTP_REQUEST {
    if { ( ( [IP::addr [IP::client_addr] equals X.X.X.X] ) && ( [HTTP::uri] contains "XYZ" ) ) } {
        drop
    }
}