Forum Discussion
hooleylist
Jun 21, 2011Cirrostratus
Hi Victor,
Since you're not specifying a different pool in the iRule, it will default to using the virtual server's pool if the request is allowed through. You can use logic like this to allow all requests from a specific set of client IPs or to an allowed URI:
when CLIENT_ACCEPTED {
if { not [matchclass [IP::client_addr] equals $::myallowedclients] }{
Client is not in the allowed class
set allowed 0
} else {
set allowed 1
}
}
when HTTP_REQUEST {
if {$allowed or [HTTP::uri] starts_with "/my_global_allowed_uri"}{
Allow request to go to pool
} else {
Disallowed request
Reset connection
reject
Send HTTP reject message
HTTP::respond 403 content {blocked!}
}
}
Or for a set of whitelisted URIs:
when CLIENT_ACCEPTED {
if { not [matchclass [IP::client_addr] equals $::myallowedclients] }{
Client is not in the allowed class
set allowed 0
} else {
set allowed 1
}
}
when HTTP_REQUEST {
Check if requested URI is whitelisted
switch -glob [HTTP::uri] {
"/allowed_starts_with/*" -
"*/allowed_contains/*" -
"/allowed_exact" {
set allowed 1
}
}
if { $allowed == 0 }{
Disallowed request
Reset connection
reject
Send HTTP reject message
HTTP::respond 403 content {blocked!}
}
}
Also, if you're on 9.4.4 or higher, you should remove the $:: prefix from the datagroup references in the iRule:
http://devcentral.f5.com/wiki/default.aspx/iRules/CMPCompatibility.html
And if you're running IIS, there are simple ways to bypass this logic:
http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/50/aft/30900/showtab/groupforums/Default.aspx31324
Aaron