For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Bhuvnesh_102719's avatar
Bhuvnesh_102719
Icon for Nimbostratus rankNimbostratus
Sep 17, 2013

block ssh for a node ip

hello experts,

We have a virtual server for anyip and port.

virtual V_Service_Forward_IP {
   ip forward
   destination any:any
   mask 0.0.0.0
   vlans service enable
}

Now I received a request from my customer to block ssh traffic for a particular IP 10.xxx.xxx.xx2. I suppose it is possible to achieve by iRule. 

when CLIENT_ACCEPTED {
    if { [[IP::remote_addr] equals 10.xxx.xxx.xx2] and [server_port == 22]} {       
        log local0. “ssh request for: [IP:remote_addr] from IP: [IP::client_addr] rejected by iRule blockssh”
        reject
    }
}

Kindly advise if it is ok or i missed something.

Many thanks.

application delivery
BIG-IP Access Policy Manager (APM)
devops
iRules
management
security

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 17, 2013

    You could also very easily do this with packet filter rules. The iRule will allows a full three-way handshake before denying the connection while the packet filter will stop it before that.

    Otherwise your iRule might look like this:

    when CLIENT_ACCEPTED {
    if { [IP::addr [IP::local_addr] equals 10.xxx.xxx.xx2] and [TCP::local_port == 22] } {
        log local0. "ssh request for: [IP::local_addr] from IP: [IP::client_addr] rejected by iRule blockssh"
        reject
    } 
}