For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ipman_1988_5418's avatar
ipman_1988_5418
Icon for Nimbostratus rankNimbostratus
Sep 25, 2013

GeoLocation iRule Client_Accepted missing some traffic

I have an iRule that fires on client_accepted applied to a virtual forwarder (0.0.0.0) that basically forwards all tcp and udp traffic (not destined to our GTM DNS virtual). The iRule does a whereis ...
application delivery
devops
iRules
ipman_1988_5418's avatar
ipman_1988_5418
Icon for Nimbostratus rankNimbostratus
Sep 25, 2013

Hey thanks for the quick response. Here's the irule and data groups (abbreviated).

when CLIENT_ACCEPTED {

if { [class match [IP::client_addr] equals allowedip]} {

} elseif { [class match [IP::client_addr] equals blockedsrcaddress]} {

  drop

} elseif { [class match [whereis [IP::client_addr] country] equals blockedcountries]} {

  drop

} elseif { [class match [IP::local_addr] equals blockeddstaddress]} {

  drop

} else {

} }

ltm data-group internal allowedip { records { 12.129.. { data FrontBridge_9 } 12.129.. { data FrontBridge_3 }

ltm data-group internal blockedcountries { records { AR { data Argentina } AT { data Austria } BG {

ltm data-group internal blockeddstaddress { records { 87.255.51.. { data Netherlands_Virus_Communications }

ltm data-group internal blockedsrcaddress { records { 198.20.. { data Shodan_CIDR } } type ip }

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Sep 25, 2013
    Thanks. So it's only the 'elseif { [class match [whereis [IP::client_addr] country] equals blockedcountries' part you have an issue with yes? How many entries in the DG? Also, how do you know they are getting through?