Forum Discussion

Alan_Millar's avatar
Alan_Millar
Icon for Nimbostratus rankNimbostratus
Jul 24, 2019

IP Filtering using Xff-clientip in iRule

We are currently using IP filtering for URIs like this:     }   elseif { ([HTTP::uri] starts_with "/site") and ( [class match [IP::client_addr] equals  management_IP])} {       use pool pSite ...
cloud
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Jul 25, 2019

    You are right Stan! Thanks for the contribution.

     

    , here is the new code:

    when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

    KR,

    Dario.

Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus

 2 optimizations to your code:

 

  • use getfield command instead of split / lindex
  • use string trim command on the result to make sure there is no space before the comma
Dario_Garrido's avatar
Dario_Garrido
Icon for MVP rankMVP
Jul 25, 2019

You are right Stan! Thanks for the contribution.

 

, here is the new code:

when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

KR,

Dario.