iRule command to allow IP range to access specific URL

Question

Hi,We are having a project that require us to allow only set of IP ranges to access specific URL. May I know if this is possible via iRule?&nbsp;

ozzy · Answer

hello ,yes it is possible.. here is the example..&nbsp;when HTTP_REQUEST {&nbsp; &nbsp; set srcip [IP::client_addr]&nbsp; &nbsp; if { [HTTP::header exists "X-Forwarded-For"] } {&nbsp; &nbsp; &nbsp; &nbsp; set srcip [HTTP::header "X-Forwarded-For"]&nbsp; &nbsp; &nbsp; &nbsp; #log local0. "USER-SOURCE $srcip"&nbsp; &nbsp; }&nbsp;&nbsp; &nbsp; if &nbsp;{ [HTTP::path] starts_with "/xzy" } {&nbsp; &nbsp; &nbsp; &nbsp; switch $srcip {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "13.174.130.182" -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "31.121.101.157" -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "35.77.107.183" {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ACCESS::disable&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}

aswin_mk · Answer

you can use this if you want to block any specific ip to a vip - Restricting access to a virtual server by IP subnet (f5.com)or please let me know if its only specific to urls?&nbsp;

jayson27 · Answer

Hi Aswin,&nbsp;Yes we will allow only specific IPs to access specific URL

jayson27 · Answer

Hi,Can you tell me if below is correct?&nbsp;if &nbsp;{ [HTTP::path] starts_with "/xzy" } {&nbsp; &nbsp; &nbsp; &nbsp; &lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt; URL&nbsp; &nbsp; &nbsp; &nbsp; switch $srcip {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "13.174.130.182" -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt; IPs Allowed?&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "31.121.101.157" -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "35.77.107.183" {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ACCESS::disable&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt; Action?&nbsp;

ozzy · Answer

hello Jayson27,it is just an example ...&nbsp;instead of ACCESS::disable .. you can user "reject" or&nbsp;HTTP::respond 403 content {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;html&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;head&gt;&lt;title&gt;403 Forbidden&lt;/title&gt;&lt;/head&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;body&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;h1&gt;403 Forbidden&lt;/h1&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;p&gt;Access denied: Your IP address does not have permission to access this resource.&lt;/p&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/body&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/html&gt;&nbsp; &nbsp; &nbsp; &nbsp; } Content-Type "text/html"&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; # ends the connection&nbsp; &nbsp; &nbsp; &nbsp; reject&nbsp; &nbsp; }

Forum Discussion

iRule command to allow IP range to access specific URL

Recent Discussions

Sending a trusted certificate to server

Balancing failure

Outlook application issue

010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure Rseries Tenant ..

Traffic Learning Section Stuck Loading After TMOS Upgrade to 17.1.1.2

Related Content

Federated AWS Console Access Made Easy: F5 BIG-IP Access Policy Manager Access Guided Configurations

Ansible - Running bash commands with bigip_command module - How it's done

Load balancing method specific decision

The table Command: Advanced Data Expiration

change content type for specific uri in http response