For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

keefyweefy's avatar
keefyweefy
Icon for Nimbostratus rankNimbostratus
Mar 08, 2011

Filter on source & destination

Hello all

 

 

I'm trying to write what I presumed would be a simple iRule to restrict access from a client. We have a forwarding (IP) VS for a subnet say 192.168.1.0/24

 

 

I'm applying the following rule to that VS however it isn't performing as expected:

 

 

when CLIENT_ACCEPTED {

 

if { [IP::addr [IP::client_addr]/32 equals 192.168.2.1]

 

and [IP::addr [IP::remote_addr]/32 equals 192.168.1.100] } {

 

drop}

 

elseif { [IP::addr [IP::client_addr]/32 equals 192.168.2.1]

 

and [IP::addr [IP::remote_addr]/32 equals 192.168.1.101] } {

 

drop

 

}

 

}

 

 

 

Connections don't get blocked from 192.168.2.1 to 192.168.1.100 or 101.

 

 

If I trim the iRule down to:

 

 

when CLIENT_ACCEPTED {

 

if { [IP::addr [IP::client_addr]/32 equals 192.168.2.1] } {

 

drop}

 

}

 

 

Then all connections do get dropped so the problem appears to be with the latter part of the arguement.

 

 

application delivery
dev
devops
iRules

5 Replies

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Mar 08, 2011
    I believe client_addr and remote_addr will return the same value in this situation. I'm wondering if local_addr is the way to go.

     

     

    Edit: Using this sample rule as an example, it definitely looks like you need to be checking local_addr instead of remote_addr. Give that a shot and see what happens.

     

     

     

    http://devcentral.f5.com/wiki/defau...uting.html

     

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Mar 08, 2011
    How about this to make things prettier? 

    
when CLIENT_ACCEPTED {
   if { [IP::client_addr] eq 192.168.2.1 } {
           switch [IP::local_addr] {
               192.168.1.100 -
               192.168.1.101 { drop } 
                 }
          }
    }
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 08, 2011
    I'd suggest using IP::addr and/or address type datagroups which will do bit comparisons instead of string comparisons of the IP addresses: 

    
when CLIENT_ACCEPTED {
   if { [IP::addr [IP::client_addr] eq 192.168.2.1] } {
      if { [IP::addr [IP::local_addr] eq 192.168.1.100] || [IP::addr [IP::local_addr] eq 192.168.1.101] 
         drop
      }
   }
}

    Aaron