Forum Discussion
AltostratusF5 iRule Geolocation restriction
when FLOW_INIT { # # Drop everything except US # if { ! ([whereis [IP::client_addr] country] equals "US") } { log -noname local0. "Dropping connection from [IP::client_addr]/[whereis [IP::client_addr] state country continent ]" drop } }AFM not required.
NimbostratusI would make sure the LTM is updated with the latest GeoLocationUpdates from F5. Otherwise you will likely block valid US addresses.
Here is one very simple way to do this:
#
# Block_non_US_IP
#
# iRule to drop traffic that is not from US addresses
#
when CLIENT_ACCEPTED {
if { not [whereis [IP::client_addr] continent country] == "NA US" } {
log local0. "Connection from [IP::client_addr] [whereis [IP::client_addr] continent country] to [virtual name] [IP::local_addr] : Blocked."
drop
}
}
AbdullahAlshehriHello David,
Thank you for your reply.
Just to clarify more, I'am using F5 DNS/LTM and I will apply the iRule on the VS.
Also, I prefer to block the traffic when TCP-SYN or UDP packet come from non-US country. I got iRule from clouddocs.f5 that may will work
when FLOW_INIT {
set ipaddr [IP::client_addr]
set locale [whereis $ipaddr country]
log local0. "IP Address/Counry $ipaddr/$locale"
switch $locale {
"US" { return }
default { ACL::action drop }
}
}
