Forum Discussion

Alan_Millar's avatar
Alan_Millar
Icon for Nimbostratus rankNimbostratus
Jul 24, 2019

IP Filtering using Xff-clientip in iRule

We are currently using IP filtering for URIs like this:     }   elseif { ([HTTP::uri] starts_with "/site") and ( [class match [IP::client_addr] equals  management_IP])} {       use pool pSite ...
cloud
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Jul 25, 2019

    You are right Stan! Thanks for the contribution.

     

    , here is the new code:

    when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

    KR,

    Dario.

Dario_Garrido's avatar
Dario_Garrido
Icon for MVP rankMVP

Hello Alan.

 

Try with this code:

when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIPList [split [HTTP::header value "X-Forwarded-For"] ","]
            set clientIP [lindex $ipList 0]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

KR,

Dario.

Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
Jul 25, 2019

 2 optimizations to your code:

 

  • use getfield command instead of split / lindex
  • use string trim command on the result to make sure there is no space before the comma
  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for MVP rankMVP
    Jul 25, 2019

    You are right Stan! Thanks for the contribution.

     

    , here is the new code:

    when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

    KR,

    Dario.

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jul 25, 2019

    From tcl string wiki

     

    string trim string ?chars?

     

    Returns a value equal to string except that any leading or trailing characters present in the string given by chars are removed. If chars is not specified then white space is removed (spaces, tabs, newlines, and carriage returns).

     

    So no need to define the space in string trim command...

  • Alan_Millar's avatar
    Alan_Millar
    Icon for Nimbostratus rankNimbostratus
    Jul 25, 2019

    This is working properly, thank you for the help!