Header injection rule

If your backend need to get actual source ip address, please allow x-forward-for n http profile 

If any specific ips only need to pool, you have to create source group or create a irule for the allow

We already check for the x-forward-for

Hi,

Do you want only need to allow specific ips or need to allow all ips and need to add header on specific ips 

If you want to allow only specific ips, then create a source group and add custom header in http profile. Use below article 

https://my.f5.com/manage/s/article/K57354286

I see that article.  I see how to insert a custom header.  I don't see how to insert a custom header based on the client request of a specific address. 

If host = mypubliccnametoaddress.mydomain.com

if address is member of address group

insert value

We're already getting the X-Forward-For address, what we need to do is look at that address, and if the X-Forward-For address matches the four addresses we want to allow, and the traffic is bound for a specific pool, insert a value.  If not, do nothing.  Once the traffic passes through the F5, our proxy looks for the inserted value and allows or denies based on the request.

Would this irule work?

when HTTP_REQUEST {
       if { [HTTP::host] eq "myhost.mydomain.com" } {
       pool MYPOOL
       }
       if { [IP::addr [IP::client_addr] equals "datagroup_name" ] } {
        HTTP::header insert "valuename" "trusted"
        }

If the client_addr comes from X-Forward-For and there is a data group named datagroup_name and an ip address is in that group, will it add "trusted"

sorry I think this should be 

when HTTP_REQUEST {
       if { [HTTP::host] eq "myhost.mydomain.com" } {
       pool MYPOOL
       }
       if { [class match [IP::client_addr] equals "datagroup_name" ] } {
        HTTP::header insert "valuename" "trusted"
        }