Forum Discussion

Alan_Millar's avatar
Alan_Millar
Icon for Nimbostratus rankNimbostratus
Jul 24, 2019
Solved

IP Filtering using Xff-clientip in iRule

We are currently using IP filtering for URIs like this:     }   elseif { ([HTTP::uri] starts_with "/site") and ( [class match [IP::client_addr] equals  management_IP])} {       use pool pSite ...
cloud
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Jul 25, 2019

    You are right Stan! Thanks for the contribution.

     

    , here is the new code:

    when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

    KR,

    Dario.

Dario_Garrido's avatar
Dario_Garrido
Icon for MVP rankMVP
Jul 24, 2019

Hello Alan.

 

Try with this code:

when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIPList [split [HTTP::header value "X-Forwarded-For"] ","]
            set clientIP [lindex $ipList 0]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

KR,

Dario.

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jul 25, 2019

     2 optimizations to your code:

     

    • use getfield command instead of split / lindex
    • use string trim command on the result to make sure there is no space before the comma
    • Dario_Garrido's avatar
      Dario_Garrido
      Icon for MVP rankMVP
      Jul 25, 2019

      You are right Stan! Thanks for the contribution.

       

      , here is the new code:

      when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

      KR,

      Dario.

    • Stanislas_Piro2's avatar
      Stanislas_Piro2
      Icon for Cumulonimbus rankCumulonimbus
      Jul 25, 2019

      From tcl string wiki

       

      string trim string ?chars?

       

      Returns a value equal to string except that any leading or trailing characters present in the string given by chars are removed. If chars is not specified then white space is removed (spaces, tabs, newlines, and carriage returns).

       

      So no need to define the space in string trim command...

    • Alan_Millar's avatar
      Alan_Millar
      Icon for Nimbostratus rankNimbostratus
      Jul 25, 2019

      This is working properly, thank you for the help!