For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sysadmin_2015_2's avatar
sysadmin_2015_2
Icon for Nimbostratus rankNimbostratus
Sep 22, 2015

iRule - Whitelisting/Blocking IP Addresses

Hello,   We use a third party for our CDN and web security. I would like to write an iRule where we whitelist only their IP ranges and block all other traffic. Can someone please assist me in wr...
arpydays's avatar
arpydays
Icon for Nimbostratus rankNimbostratus
Sep 22, 2015

If you know their IP ranges then a simple irule/datagroup would do it. This rule will drop any connections from clients not in the 'allowed-nets' datagroup,

cheers

when CLIENT_ACCEPTED {
  if { not ([class match [IP::client_addr] equals allowed-nets]) } {
    log local0. "[IP::client_addr] is not permitted to site xxxx"
    drop
  }
}

ltm data-group internal allowed-netss {
    records {
        192.168.20.0/24 {
            data "NetYYYY"
        }
    }
    type ip
}