For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Vince_Beltz_959's avatar
Vince_Beltz_959
Icon for Nimbostratus rankNimbostratus
Oct 22, 2009

Drop Doesn't

I've implemented the following iRule to filter out certain user agents from connecting to our servers. Testing with Firefox and the Modify Headers add-on, it seems to work - I get a disconnected messa...
application delivery
dev
devops
iRules
Vince_Beltz_959's avatar
Vince_Beltz_959
Icon for Nimbostratus rankNimbostratus
Oct 22, 2009
Log excerpt below - seems to be working exactly as expected, first allowing a connection, then failing several times as I tested various User-Agent strings from the rule with the Modify Headers add-on. then working again when I disabled all the User-Agent mods. The log entries look exactly the same, just noting "Closing TCP Connection" regardless of the method used, TCP::close, drop, or reject.

 

Oct 22 15:19:19 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:38440: New GET request to x.x.x.x/ with UA Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)

 

Oct 22 15:19:19 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:38440: UA didn't check, redirecting.

 

Oct 22 15:19:54 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:38440: New GET request to x.x.x.x/ with UA Azureus

 

Oct 22 15:19:54 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:38440: Matched UA check. Closing TCP connection.

 

Oct 22 15:19:54 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39202: New GET request to x.x.x.x/ with UA Azureus

 

Oct 22 15:19:54 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39202: Matched UA check. Closing TCP connection.

 

Oct 22 15:19:54 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39207: New GET request to x.x.x.x/favicon.ico with UA Azureus

 

Oct 22 15:19:54 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39207: Matched UA check. Closing TCP connection.

 

Oct 22 15:19:57 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39235: New GET request to x.x.x.x/favicon.ico with UA Azureus

 

Oct 22 15:19:57 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39235: Matched UA check. Closing TCP connection.

 

Oct 22 15:21:09 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39925: New GET request to x.x.x.x/ with UA Windows-Media-Player

 

Oct 22 15:21:09 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:39925: Matched UA check. Closing TCP connection.

 

Oct 22 15:21:29 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:40201: New GET request to x.x.x.x/ with UA Torrent

 

Oct 22 15:21:29 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:40201: Matched UA check. Closing TCP connection.

 

Oct 22 15:21:36 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:40254: New GET request to x.x.x.x/ with UA Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)

 

Oct 22 15:21:36 tmm tmm[1121]: Rule filter.useragent : x.x.x.x:40254: UA didn't check, redirecting.