Forum Discussion

Fastidious's avatar
Fastidious
Icon for Altostratus rankAltostratus
Jun 21, 2024

Help with iRule

Good day all! I have the following iRule: when HTTP_REQUEST { if { ([HTTP::host] eq "lists.example.com") and ([HTTP::uri] eq "/cgi-bin/wa?INDEX" || [HTTP::uri] eq "/cgi-bin/wa?MOD" || [HTTP::uri...
irule
LTM VE
  • JRahm's avatar
    JRahm
    Jun 21, 2024

    You can negate that second IF as well to avoid the else

    when HTTP_REQUEST priority 500 {
    if { (![class match -- [IP::client_addr] eq "LISTSERV-TST_Allowed_IPs"]) &&
         !(([HTTP::host] eq "lists.example.com") && ([HTTP::uri] matches_glob "/cgi-bin/wa?SUBEDIT1*")) } {
        HTTP::redirect "https://www.google.com"
    }
}

     

JRahm's avatar
JRahm
Icon for Admin rankAdmin
Jun 21, 2024

Hi Fastidious , untested, but I think this is close to what you're looking for:

when HTTP_REQUEST priority 500 {
    if { ([HTTP::host] eq "lists.example.com") && ([HTTP::uri] matches_glob "/cgi-bin/wa?SUBEDIT1*") } {
        if { ![class match -- [IP::client_addr] eq "LISTSERV-TST_Allowed_IPs"] } {
            HTTP::redirect "https://www.google.com"
        }
    }
}

 

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Jun 21, 2024

    I'm a little fuzzy on your "isn't" clause for the /cgi-bin requirement, so that might need to be negated or the logic cleaned up a bit.

  • Fastidious's avatar
    Fastidious
    Icon for Altostratus rankAltostratus
    Jun 21, 2024

    JRahmthank you, and very close! I want every client not on "LISTSERV-TST_Allowed_IPs" to be allowed to access line 2, but only line 2. Redirect is there is no match.

    Allow access to everything matching "/cgi-bin/wa*" to every client on "LISTSERV-TST_Allowed_IPs" data group.

  • Fastidious's avatar
    Fastidious
    Icon for Altostratus rankAltostratus
    Jun 21, 2024

    Would something like this work?

    when HTTP_REQUEST priority 500 {
    if { ([HTTP::host] eq "lists.example.com") && ([HTTP::uri] matches_glob "/cgi-bin/wa?SUBEDIT1*") } { 
      return 
    } else {
            HTTP::redirect "https://www.google.com"    
    }
    if { [class match -- [IP::client_addr] eq "LISTSERV-TST_Allowed_IPs"] } {
      return
    }
}

     

    • Fastidious's avatar
      Fastidious
      Icon for Altostratus rankAltostratus
      Jun 21, 2024

      Or this, rather:

      when HTTP_REQUEST priority 500 {
  if { ![class match -- [IP::client_addr] eq "LISTSERV-TST_Allowed_IPs"] } {
    if { ([HTTP::host] eq "lists.example.com") && ([HTTP::uri] matches_glob "/cgi-bin/wa?SUBEDIT1*") } { 
          return 
    } else {
          HTTP::redirect "https://www.google.com"
    }
  }
}

      I know we are close, so I am not certain on how to "wrap it up".  😅

      • JRahm's avatar
        JRahm
        Icon for Admin rankAdmin
        Jun 21, 2024

        You can negate that second IF as well to avoid the else

        when HTTP_REQUEST priority 500 {
    if { (![class match -- [IP::client_addr] eq "LISTSERV-TST_Allowed_IPs"]) &&
         !(([HTTP::host] eq "lists.example.com") && ([HTTP::uri] matches_glob "/cgi-bin/wa?SUBEDIT1*")) } {
        HTTP::redirect "https://www.google.com"
    }
}