For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Vadym_Chepkov's avatar
Vadym_Chepkov
Icon for Nimbostratus rankNimbostratus
Jul 13, 2016

How to filter private IP space from DNS_RESPONSE

We would like to return 'not found' answer if an "outsider" requested A record with IP from private rfc1918 networks. How one would accomplish that with iRule? I saw some filtering examples available...
BIG-IP DNS
iRules
security
Vadym_Chepkov's avatar
Vadym_Chepkov
Icon for Nimbostratus rankNimbostratus
Jul 13, 2016

I started with this :

  when DNS_RESPONSE {
    if { not [class match [IP::client_addr] eq "local_net" ] } { 
      foreach entry [DNS::answer] {
        if {[DNS::type $entry] eq "A"} {
          if { [class match [DNS::rdata $entry] eq "private_net"] } {
             need to return not found here
          }
        }
      }
    }
  }