For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

CHRISTY_THOMAS's avatar
CHRISTY_THOMAS
Icon for Cirrus rankCirrus
Jan 05, 2024

How to restrict a url access from a specific two ip's

Hi, How to retsrict a url access from internet for a specific two ip's !  whether it can be achieved via LTM policy or via irule? logic that i have cretaed using irule given below: when HTTP_REQU...
application delivery
devops
security
Michael_Saleem's avatar
Michael_Saleem
Icon for MVP rankMVP
Jan 05, 2024

Could you confirm whether source IPs 104.123.3.1 and 117.23.2.1 should be *allowed* to access path "/abc/update". Or should they be denied?

CHRISTY_THOMAS's avatar
CHRISTY_THOMAS
Icon for Cirrus rankCirrus
Jan 05, 2024

 

only IPs 104.123.3.1 and 117.23.2.1  can acces to path "/abc/update". remainng Ip connections from internet towards acess path "/abc/update" should be droped/blocked

  • Michael_Saleem's avatar
    Michael_Saleem
    Icon for MVP rankMVP
    Jan 05, 2024

    Thanks for confirming.

    I made a few minor adjustments to fix syntax issues, but this should work:

    when HTTP_REQUEST {

if { [HTTP::path] contains "/abc/update" and (([IP::addr [IP::client_addr] equals 104.123.3.1]) or ([IP::addr [IP::client_addr] equals 117.23.2.1])) } {
}
else {
    reject
}
}
    • CHRISTY_THOMAS's avatar
      CHRISTY_THOMAS
      Icon for Cirrus rankCirrus
      Jan 05, 2024

      i have checked in my application. while i am calling this irule in VS the other url's pertaining to the application also not loading in the browser

      • CHRISTY_THOMAS's avatar
        CHRISTY_THOMAS
        Icon for Cirrus rankCirrus
        Jan 05, 2024

        i have checked LTM logs also below error recieving:

        tmm[9714]: 01220001:3: TCL error: /Common/UIp_TEST <HTTP_REQUEST> - invalid command name "if{/" while executing "if{[HTTP::path] contains "/uHi/upjateMobShSRrq" and (([IP::addr [IP::client_addr] equals 1XX.250.X0.X]) or ([IP::addr [IP::client_addr] equals 1XX.1XX..."