iRule - Whitelisting/Blocking IP Addresses

If you know their IP ranges then a simple irule/datagroup would do it. This rule will drop any connections from clients not in the 'allowed-nets' datagroup,

cheers

when CLIENT_ACCEPTED {
  if { not ([class match [IP::client_addr] equals allowed-nets]) } {
    log local0. "[IP::client_addr] is not permitted to site xxxx"
    drop
  }
}

ltm data-group internal allowed-netss {
    records {
        192.168.20.0/24 {
            data "NetYYYY"
        }
    }
    type ip
}

Hello,

Thank you for the reply. Our F5 is at the edge. If I create a data group with the listed CDN's IP'S called allowed-nets, do I still have to include them in the iRule? if so does the below look correct?

when CLIENT_ACCEPTED { if { not ([class match [IP::client_addr] equals allowed-nets]) } { log local0. "[IP::client_addr] is not permitted to site xxxx" reject } }

ltm data-group internal allowed-netss { records { 192.168.20.0/24, 192.178.20.0/24, 192.188.20.0/24 { data "NetYYYY" } } type ip }

Thank you,

No, the data group is not part of the irule, you can create it in the gui under local traffic > irule > data group, cheers