For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Angelo's avatar
Angelo
Icon for Nimbostratus rankNimbostratus
Nov 07, 2012

I-rule not working

Hi

 

 

I have a i-rule to allow multiple ports but for some reason it's not working... i can connect on any port

 

when CLIENT_ACCEPTED {

 

if { [TCP::client_port] == 8300 or [TCP::client_port] == 8301 or [TCP::client_port] == 8401 or [TCP::client_port] == 8881 or [TCP::client_port] == 8880 or [TCP::client_port] == 8731 or [TCP::client_port] == 8732 or [TCP::client_port] == 4353 or [TCP::client_port] == 8733 or [TCP::client_port] == 8525 } {

 

drop

 

}

 

}

 

application delivery
dev
devops
iRules

2 Replies

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Nov 07, 2012

    More than two 'or' statements really isn't manageable. Can I suggest you create a Data Group of the ports you want to deny and use this;

    when CLIENT_ACCEPTED { if { [class match [string [TCP::client_port] equals denied-ports ] } { drop } }

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Nov 07, 2012
    Actually, I think it should be TCP::local_port; 

    when CLIENT_ACCEPTED {
 if { [class match [string [TCP::local_port] equals denied-ports ] } {
   drop }
}