For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cbarnett_13782's avatar
cbarnett_13782
Icon for Nimbostratus rankNimbostratus
Feb 16, 2009

Block ssl requests by ip

We need to test out a website befor we roll it out to production. So to test we want to only allow certian IP addresses accessing a virtual server. I have this working nicely for the HTTP virtual serv...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Feb 16, 2009
Possibly. What are the symptoms of the failure? Do you see any errors logged in /var/log/ltm? Can you add debug logging to the iRule to see what's happening? 

 
  when CLIENT_ACCEPTED {  
  
     log local0. "[IP::client_addr]:[TCP::client_port]: New TCP connection established." 
  
      Check if client IP is part of the subnet we want to allow  
     if {[IP::addr [IP::client_addr] equals 10.0.0.0/8]}{  
  
         Specify the pool  
        log local0. "[IP::client_addr]:[TCP::client_port]: Legal IP. Connection allowed to pool." 
        pool WEBPOOL  
  
     } else {  
  
         Reset the TCP connection  
        log local0. "[IP::client_addr]:[TCP::client_port]: Invalid IP. Resetting TCP connection." 
        reject  
     }  
  }

Aaron