Forum Discussion
help on an irule
Hello,
I have the following irule which is working fine:
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/EBanking2/admin" } { if { not ([IP::client_addr] equals "208.222.129.101") } { HTTP::redirect "http://www.coop.com.cy" log local0. "IP: [IP::client_addr] tried to access /EBanking2/admin from the Internet." } } }
I need your assistance on the fact that the EQUALS must be either of two IP addresses i.e.
equals "208.222.129.101" OR "another IP"
in order for this to work, do I have to use brackets or ??
Please advise. Tx
5 Replies
- VernonWells
Employee
Your rule:
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/EBanking2/admin" } { if { not ([IP::client_addr] equals "208.222.129.101") } { HTTP::redirect "http://www.coop.com.cy" log local0. "IP: [IP::client_addr] tried to access /EBanking2/admin from the Internet." } } }So I assume you want to redirect when the client source address is neither 208.222.129.101 nor the other address. If so (and using 203.0.113.1 as the other IP for this example):
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/EBanking2/admin" } { if { not ([IP::client_addr] equals "208.222.129.101" or [IP::client_addr] equals "203.0.113.1") } { HTTP::redirect "http://www.coop.com.cy" log local0. "IP: [IP::client_addr] tried to access /EBanking2/admin from the Internet." } } }An alternative would be to use a data-group. So, you would define a data-group like this:
create ltm data-group internal non-redirect-ips type ip records add { 208.222.129.101 {} 203.0.113.1 {} }Then change the iRule thusly:
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/EBanking2/admin" and ![class match [IP::client_addr] equals non-redirect-ips]} { HTTP::redirect "http://www.coop.com.cy" log local0. "IP: [IP::client_addr] tried to access /EBanking2/admin from the Internet." } }The advantage is that you can add, change or delete IP addresses that are exempted without changing the iRule itself. You need only alter the data-group, which can be done via tmsh or the WebUI.
- cmard_195831
Nimbostratus
Thank you for your feedback. We will try and let you know
- Vernon_97235Historic F5 Account
Your rule:
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/EBanking2/admin" } { if { not ([IP::client_addr] equals "208.222.129.101") } { HTTP::redirect "http://www.coop.com.cy" log local0. "IP: [IP::client_addr] tried to access /EBanking2/admin from the Internet." } } }So I assume you want to redirect when the client source address is neither 208.222.129.101 nor the other address. If so (and using 203.0.113.1 as the other IP for this example):
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/EBanking2/admin" } { if { not ([IP::client_addr] equals "208.222.129.101" or [IP::client_addr] equals "203.0.113.1") } { HTTP::redirect "http://www.coop.com.cy" log local0. "IP: [IP::client_addr] tried to access /EBanking2/admin from the Internet." } } }An alternative would be to use a data-group. So, you would define a data-group like this:
create ltm data-group internal non-redirect-ips type ip records add { 208.222.129.101 {} 203.0.113.1 {} }Then change the iRule thusly:
when HTTP_REQUEST { if { [HTTP::uri] starts_with "/EBanking2/admin" and ![class match [IP::client_addr] equals non-redirect-ips]} { HTTP::redirect "http://www.coop.com.cy" log local0. "IP: [IP::client_addr] tried to access /EBanking2/admin from the Internet." } }The advantage is that you can add, change or delete IP addresses that are exempted without changing the iRule itself. You need only alter the data-group, which can be done via tmsh or the WebUI.
- cmard_195831
Nimbostratus
Thank you for your feedback. We will try and let you know
- Greg_Labelle
Nimbostratus
You could use an OR statement, but I would recommend you move to using an iRule data group, and do a class match, for example:
if { [class match [IP::client_addr] equals IPWhiteList] } { ... }Where "IPWhiteList" is an iRule data group (of type string) that contains the IP's to be permitted.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com