Forum Discussion
Masaru_Takahash
Nimbostratus
NimbostratusIPv6 address prefix difinition
Please teach the definition method when the IPv6 address is used.
I did not do the operation for which I had hoped though I tried various rule.
I want to make the rule that limits only the access from 3ffe:1234:1234:5678::/64 prefix.
However, it did not operate in the following rule.
[Rule 1]
-------------------------------------------------------
when CLIENT_ACCEPTED {
if { [IP::remote_addr] eq 3ffe:1234:1234:5678::/64 ] }
{
pool lb_pool
} else {
discard
}
}
-------------------------------------------------------
[Rule 2]
-------------------------------------------------------
when CLIENT_ACCEPTED {
if { [IP::remote_addr] eq 3ffe:1234:1234:5678::0 netmask ffff:ffff:ffff:ffff::0 ] }
{
pool lb_pool
} else {
discard
}
}
-------------------------------------------------------
Please teach the method of defining rule that can recognize the Prefix
3 Replies
- As drteeth pointed out in an earlier post today: "Listen to the forum"!
You are comparing the IP addresses as strings. Thus the application of a netmask is not observed at all. To accomplish this you need to compare the IP addresses as IP addresses by using the IP::addr command.
Also, there is currently an issue with comparing network masks that has been corrected in 9.0.5, which involves which address you apply the mask to. In pre-9.0.5 versions, you need to apply the netmask to host address.
Here's an Example:when CLIENT_ACCEPTED { if { [IP::addr "[IP::remote_addr]/64" eq 3ffe:1234:1234:5678::] } { pool lb_pool } else { discard } }
Also, you can use either / notation or " mask " notation. However, with the long netmasks of IPv6, I would suggest sticking with the / notation.
Second example:when CLIENT_ACCEPTED { if { [IP::addr "[IP::remote_addr] mask ffff:ffff:ffff:ffff::0" eq "3ffe:1234:1234:5678::"] } { pool lb_pool } else { discard } }
After 9.0.5, you can do the following:when CLIENT_ACCEPTED { if { [IP::addr [IP::remote_addr] eq 3ffe:1234:1234:5678::/64] } { pool lb_pool } else { discard } } 
Masaru_TakahashI tested by both V9.0.2 and V9.0.4.
When all samples were changed from "eq" to "equals", it operated correctly.
However, only one sample operated in V9.0.4.
V9.0.2(OK), V9.0.4(OK)
---------------------------------------------------------------------
when CLIENT_ACCEPTED {
if { [IP::addr "[IP::remote_addr]/64" equals 3ffe:1234:1234:5678::] } {
pool lb_Pool
} else {
discard
}
}
---------------------------------------------------------------------
V9.0.2(OK), V9.0.4(NG)
---------------------------------------------------------------------
when CLIENT_ACCEPTED {
if { [IP::addr "[IP::remote_addr] mask ffff:ffff:ffff:ffff::0" equals "3ffe:1234:1234:5678::"] } {
pool lb_Pool
} else {
discard
}
}
---------------------------------------------------------------------
V9.0.2(OK), V9.0.4(NG)
---------------------------------------------------------------------
when CLIENT_ACCEPTED {
if { [IP::addr [IP::remote_addr] equals 3ffe:1234:1234:5678::/64] } {
pool lb_Pool
} else {
discard
}
}
---------------------------------------------------------------------- Can you please open a support case with the information about when it does not work as expected? That is the best route to getting things corrected in a future release. Thanks.
