IP restriction irule

I still can't get this to work, can anyone help? Looks like if it doesn't discard it then it doesn't work. Like the default doesn't do anything? Does that make sense?

 

This is what I have, do I need an "else" or something else?

 

 

when CLIENT_ACCEPTED {

 

if {!( [class match [IP::client_addr] equals ESB]) }{

 

Log dropped requests

 

log local0. "Invalid client IP: [IP::client_addr] - discarding"

 

 

drop the request

 

discard

 

}

 

}

 

 

 

Thanks

 

Joe