Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Lindsay_Stratto's avatar
Lindsay_Stratto
Icon for Nimbostratus rankNimbostratus
Nov 15, 2017

geolocation blocking

using an irule to determine geolocation and block

 

3 Replies

  • you want one? you have one?

     

    if you want one perhaps you should google a bit first, it isn't that hard.

     

  • Hello Lindsay,

     

    You can use an iRule or also an LTM policy in order to filter for traffic based on geolocation and reject them. An iRule gives you the opportunity to drop the traffic, so the malicious/suspicious user won't know whether or not their request made it to the end destination. For example, if you want to reject/drop suspicious traffic from Iran, you can use an iRule like this:

     

    when CLIENT_ACCEPTED {
        if {[whereis [IP::client_addr] country] == "IR"} { 
            drop
        }
    }

    For more info on the "whereis" command: https://devcentral.f5.com/wiki/iRules.whereis.ashx

     

    The country code you specify for the whereis command within the iRule or the LTM policy is based on ISO-3166-2: https://en.wikipedia.org/wiki/ISO_3166-2