Forum Discussion
VictorC
Jun 21, 2011Nimbostratus
HTTP VS: Only allow specific client IP but open specific /uri for all.
Hi,
Currently I have an iRule on a HTTP VS that discards requests if the client IP is not in the allow class. Now I have to add an extra requirement to allow 'all' if a specific /uri is given. Here's my current iRule (thanks to previous posts found in the forum).
class myallowedclients {
host 111.22.33.1
host 111.22.33.2
}
rule restrict-rule {
when CLIENT_ACCEPTED {
if { [matchclass [IP::client_addr] equals $::myallowedclients] }{
Do nothing...irule will complete and request will be sent to the pool based on virtual server definition
} else {
discard }
}
}
I may have to use this requirement for multiple HTTP VS with the same client allow list, but different pools so it'd be great if I can use one rule for all.
Thanks in advance.
Victor
- Colin_Walker_12Historic F5 AccountIt sounds like what you're looking for is pretty simple, something like this:
when CLIENT_ACCEPTED { if { ! (([matchclass [IP::client_addr] equals $::myallowedclients]) || ([string tolower [HTTP::uri]] eq "/letmein"))}{ discard } }
- hooleylistCirrostratusHi Victor,
when CLIENT_ACCEPTED { if { not [matchclass [IP::client_addr] equals $::myallowedclients] }{ Client is not in the allowed class set allowed 0 } else { set allowed 1 } } when HTTP_REQUEST { if {$allowed or [HTTP::uri] starts_with "/my_global_allowed_uri"}{ Allow request to go to pool } else { Disallowed request Reset connection reject Send HTTP reject message HTTP::respond 403 content {blocked!} } }
when CLIENT_ACCEPTED { if { not [matchclass [IP::client_addr] equals $::myallowedclients] }{ Client is not in the allowed class set allowed 0 } else { set allowed 1 } } when HTTP_REQUEST { Check if requested URI is whitelisted switch -glob [HTTP::uri] { "/allowed_starts_with/*" - "*/allowed_contains/*" - "/allowed_exact" { set allowed 1 } } if { $allowed == 0 }{ Disallowed request Reset connection reject Send HTTP reject message HTTP::respond 403 content {blocked!} } }
- VictorCNimbostratusWow you guys are quick! Thanks for the replies. I will test them out with the requester. Thanks again!
- Colin_Walker_12Historic F5 AccountSure thing, let us know how it goes. ;)
- VictorCNimbostratusColin,
- Colin_Walker_12Historic F5 AccountWoops, I didn't even pay attention to what event you were working in. You'd need to move the iRule (or at least the HTTP portion) into the HTTP_REQUEST event.
- hooleylistCirrostratusCan you clear your browser cache and retest? If the issue still recurs, can you add debug logging and check /var/log/ltm for the output?
when CLIENT_ACCEPTED { if { [matchclass [IP::client_addr] equals $::myallowedclients] }{ set allowed 1 log local0. "[IP::client_addr]:[TCP::client_port]: Client is in allowed class" } else { Client is not in the allowed class set allowed 0 log local0. "[IP::client_addr]:[TCP::client_port]: Client is not in allowed class" } } when HTTP_REQUEST { Check if requested URI is whitelisted switch -glob [HTTP::uri] { "/allowed_starts_with/*" - "*/allowed_contains/*" - "/allowed_exact" { set allowed 1 log local0. "[IP::client_addr]:[TCP::client_port]: URI is allowed per whitelist" } } if { $allowed == 0 }{ Disallowed request Reset connection reject Send HTTP reject message HTTP::respond 403 content {blocked!} log local0. "[IP::client_addr]:[TCP::client_port]: Blocking request" } }
- VictorCNimbostratusOk, I've cleared my cookies and cache. Here are the steps I took, followed by what I see in the log. (I'm using the HTTP::respond 403 content)
- hooleylistCirrostratusSorry, I should have included the URI in the logs. Can you try this?
when CLIENT_ACCEPTED { if { [matchclass [IP::client_addr] equals $::myallowedclients] }{ set allowed 1 log local0. "[IP::client_addr]:[TCP::client_port]: Client is in allowed class" } else { Client is not in the allowed class set allowed 0 log local0. "[IP::client_addr]:[TCP::client_port]: Client is not in allowed class" } } when HTTP_REQUEST { Check if requested URI is whitelisted switch -glob [HTTP::uri] { "/allowed_starts_with/*" - "*/allowed_contains/*" - "/allowed_exact" { set allowed 1 log local0. "[IP::client_addr]:[TCP::client_port]: URI is allowed per whitelist [HTTP::uri]" } } if { $allowed == 0 }{ Disallowed request Reset connection reject Send HTTP reject message HTTP::respond 403 content {blocked!} log local0. "[IP::client_addr]:[TCP::client_port]: Blocking request to [HTTP::uri]" } }
- VictorCNimbostratusHome page (shows blocked!)
Recent Discussions
Related Content
Â
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects