For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

krmidhun_323560's avatar
krmidhun_323560
Icon for Nimbostratus rankNimbostratus
Aug 09, 2017
Solved

iRule redirect with URL masking and URI rewrite

Hi,   I am looking for a iRule to do a URL redirection and also appending a URI to the redirected URL. The redirected URL should be masked so that the client will not see that in the address bar. ...
application delivery
iRules
LTM
  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Aug 09, 2017

    Hi,

    You can't achieve what you are expecting without using iframes. But I strongly discourage you to use them for security reasons.

    You can instead redirect to a relative path and then forward the request to the correct backend server :

    `

    when HTTP_REQUEST { 

    if { [HTTP::host] contains "buyer.abc.com" and [HTTP::path] eq "/" } {
        HTTP::redirect "/apm/rest/MOBILITY/authService/1.0" 
        return
    }
    if {[HTTP::host] contains "buyer.abc.com" and [HTTP::path] eq "/apm/rest/MOBILITY/authService/1.0"} {
        node myserver01 9001
        return 
    }
}

    `

Yann_Desmarest_'s avatar
Yann_Desmarest_
Icon for Nacreous rankNacreous
Aug 09, 2017

Hi,

You can't achieve what you are expecting without using iframes. But I strongly discourage you to use them for security reasons.

You can instead redirect to a relative path and then forward the request to the correct backend server :

`

when HTTP_REQUEST { 

    if { [HTTP::host] contains "buyer.abc.com" and [HTTP::path] eq "/" } {
        HTTP::redirect "/apm/rest/MOBILITY/authService/1.0" 
        return
    }
    if {[HTTP::host] contains "buyer.abc.com" and [HTTP::path] eq "/apm/rest/MOBILITY/authService/1.0"} {
        node myserver01 9001
        return 
    }
}

`

Yann_Desmarest_'s avatar
Yann_Desmarest_
Icon for Nacreous rankNacreous
Aug 10, 2017

Ok so, you configured as follow :

 

Your backend is listening on port 9001 but require http or https ?

 

Based on this configuration and assuming that the backend is HTTPS too, you should have :

 

buyer_vs_https

 

  • SSL Client Profile
  • SSL Server Profile

buyer_vs_9001

 

  • SSL Client Profile
  • SSL Server Profile

The rest of the configuration looks fine.

 

Now you should check the request/response on the client side.

 

If the client is redirected back to buyer_vs_9001, it may not work in direct because you don't have SNAT enabled and Firewall rules block the connection.