iRule to add IP to blacklist/feed

Hi,

You can try with the following example, not perfect but I think can be a good start for your need :

when RULE_INIT {
    set static::irule_name     "irule-blackhole"
    set static::log_server     ""
    set static::log_pri        "local0."
    set static::fail_tab       "fails"
    set static::blacklist_tab  "blackhole"
    set static::max_failures   5
    set static::fail_memory    300
    set static::block_duration 300
}   

when CLIENT_ACCEPTED {
    if {[table lookup -subtable $static::blacklist_tab [IP::client_addr]] == 1} {
         Block source IPs exceeding the number of failed logons in the timeout period
        log $static::log_pri "[virtual] - BLACKHOLED IPADDR [IP::client_addr]:[TCP::client_port] (Reputation=[IP::reputation [IP::client_addr]])"
        reject
        return
    }
}

when HTTP_REQUEST {

    if {[table lookup -subtable $static::blacklist_tab [IP::client_addr]] == 1} {
         Block source IPs exceeding the number of failed logons in the timeout period
        log $static::log_pri "[virtual] - BLACKHOLED IPADDR [IP::client_addr]:[TCP::client_port] (Reputation=[IP::reputation [IP::client_addr]])"
        reject
        return
    }

    if { [HTTP::path] eq "/admin" } {
            table set -subtable $static::fail_tab -notouch -excl [IP::client_addr] 0 indef $static::fail_memory
            table incr -subtable $static::fail_tab [IP::client_addr]

            if {[table lookup -subtable $static::fail_tab [IP::client_addr]] >= $static::max_failures} {
                set now [clock seconds]
                set now_date [split [clock format $now -format {%X %x}] " "]

                set later [expr {$now + $static::block_duration}]
                set later_date [split [clock format $later -format {%X %x}] " "]

                log $static::log_pri "[virtual] - BLACKHOLING IPADDR - [IP::client_addr] (Reputation=[IP::reputation [IP::client_addr]]) at $now_date until $later_date"
                table set -subtable $static::blacklist_tab -excl [IP::client_addr] 1 indef $static::block_duration
            }
    }
}