For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

zblue_123071's avatar
zblue_123071
Icon for Altocumulus rankAltocumulus
Aug 21, 2013

iRule to Allow Certain Client IP

Hi,

 

I have a situation where I need to permit certain IPs to access HTTP content, to do this, I have an iRule that is using a switch based off of the client IP like this:

 

when HTTP_REQUEST {
    if { [HTTP::host] contains "my.site.com" } { 
        switch [IP::addr [IP::client_addr] mask 255.255.255.255] {
            "1.2.3.4" {     
                my-pool
            } default {
                    HTTP::respond 200 content [ifile get AccessDenied]
            }
        }
    }
}

My problem is if I need to allow multiple IPs, I have to repeat several lines of code - is there a more efficient way to do this?

 

Thank you!

 

application delivery
availability
BIG-IP Access Policy Manager (APM)
design
devops
iRules
security

4 Replies

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Aug 21, 2013

    you bet. Use a datagroup and then use the class command to extract the pool you want based on source.

    ltm data-group internal /Common/iplist {
    records {
        192.168.1.1/32 {
            data my-pool
        }
        192.168.2.0/24 {
            data your-pool
        }
    }
    type ip
}


when HTTP_REQUEST {
  if { ([HTTP::host] contains "my.site.com" } {
    set pool [class match -value -- [IP::client_addr] equals iplist]
    catch { pool $pool }
  } else {
    HTTP::respond 200 content [ifile get AccessDenied]
  }
}
  • zblue_123071's avatar
    zblue_123071
    Icon for Altocumulus rankAltocumulus
    Aug 21, 2013

    Thanks allot guys - I didn't even think about using datagroups. I'll follow up with my rule after I get it working!

     

    Thanks

     

  • zblue_123071's avatar
    zblue_123071
    Icon for Altocumulus rankAltocumulus
    Aug 21, 2013

    Okay, here is what I ended up doing: 

    when HTTP_REQUEST {
    switch [HTTP::host] {
        "my.site.com" {
            if { [class match [IP::remote_addr] equals MYDATAGROUP] } {
                pool MYPOOL
            } else {
                HTTP::respond 200 content [ifile get AccessDenied]
            }
        }
    }
}

    Thanks again for the suggestions!