iRule and data group not matching properly

@LyonsG is right - you want to use "type ip" and preferably netmasks.

A couple of questions:

1. Where does the value for "True-Client-IP" come from?
2. Is there a specific reason you're inserting XFF via an iRule instead of in the HTTP-Profile?
3. Is there a specific reason you're using a header value to get to the client IP address (vs. using

   IP::client_addr

   )?
4. Wouldn't it be better to return a 503 (Service Unavailable) instead of a 302 (Temporary Redirect) followed by (presumably) a 200 (OK)?
5. How are you activating the maintenance rule? (if you're changing the iRule that may not affect existing connections).