Forum Discussion
DNS domain blocking using UDP payload
hi, , we are trying to filter some DNS quueries in our bigIP, but face some problems - running version is 10.1 - only LTM license that means we can not use DNS irules statements, so we though about using UDP payload features for that reason we tried the following
when CLIENT_ACCEPTED { set payload [UDP::payload] if {[matchclass $payload contains "google"]} { reject } } this is working and it is able to reject DNS queries to google, www.google.com, etc but if we write down $payload contains "www.google.com"]} it is not working, neither for google, nor for google.com we tried to check the payload itself (logging it) and it shows something like blablablawwwgooglecomblablabla, without the dot between google and com any idea? we are interested in filtering www.google.com and not google or google.com (this is just an example, URL is different in life system) thanks a lot in advance
24 Replies
- Mike_72892
Nimbostratus
I just wanted to post an update. There was a configuration issue relating to having an SNAT with the same IP as the VS. If the query response took longer than the timeout, a SNAT session would be created in the PVA and further packets from the client never fired the iRule. Thanks for all of your help!
- The_Bhattman
Nimbostratus
Thanks for the follow up.
-=Bhattman=-
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
