Forum Discussion

grilledcheez_21's avatar
grilledcheez_21
Icon for Nimbostratus rankNimbostratus
Nov 17, 2015

iRule to allow only some IPs, Data traffic.

Hello,

I'm trying to create an iRule for only allowing certain IPs through to a VIP. I was given this iRule by a co-worker, but it doesn't seem to work. All traffic appears to be getting blocked. I've seen similar rules for HTTP traffic, but this is not an HTTP service, it's just data.

Was hoping someone could take a look and see if I'm missing anything in the rule?

when CLIENT_ACCEPTED {
  switch [IP::client_addr] {
        10.XX.XX.XX -
        10.XX.XX.XX -
        10.XX.XX.XX -
        10.XX.XX.XX -
        10.XX.XX.XX -
        10.XX.XX.XX { return }
  }
  reject 
  log local0. "Connection rejected from [IP::client_addr]"
}

Thanks.

  • Couple things. Try adding

    IP::addr
    and put your reject in the
    default
    command.

    when CLIENT_ACCEPTED {
        switch [IP::addr [IP::client_addr]] {
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX { return }
            default {
                reject
                log local0. "Connection rejected from [IP::client_addr]"
            }
        }
    }
    
  • Couple things. Try adding

    IP::addr
    and put your reject in the
    default
    command.

    when CLIENT_ACCEPTED {
        switch [IP::addr [IP::client_addr]] {
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX { return }
            default {
                reject
                log local0. "Connection rejected from [IP::client_addr]"
            }
        }
    }
    
    • Brad_Parker_139's avatar
      Brad_Parker_139
      Icon for Nacreous rankNacreous
      Also, if you ever plan on expanding the list of allowed IPs a data group would be better to manage. when CLIENT_ACCEPTED { if { [class match [IP::addr [IP::client_addr]] equals allowedIPs_dg] }{ return } else { reject log local0. "Connection rejected from [IP::client_addr]" } }
    • grilledcheez_21's avatar
      grilledcheez_21
      Icon for Nimbostratus rankNimbostratus
      So interestingly, it seemed to have caused the servers to not connect that I was trying to allow. I'm trying to allow the ones listed in the iRule. Anyway, apparently the servers returned with a bunch of SSL failures.
  • Couple things. Try adding

    IP::addr
    and put your reject in the
    default
    command.

    when CLIENT_ACCEPTED {
        switch [IP::addr [IP::client_addr]] {
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX -
            10.XX.XX.XX { return }
            default {
                reject
                log local0. "Connection rejected from [IP::client_addr]"
            }
        }
    }
    
    • Brad_Parker's avatar
      Brad_Parker
      Icon for Cirrus rankCirrus
      Also, if you ever plan on expanding the list of allowed IPs a data group would be better to manage. when CLIENT_ACCEPTED { if { [class match [IP::addr [IP::client_addr]] equals allowedIPs_dg] }{ return } else { reject log local0. "Connection rejected from [IP::client_addr]" } }
    • grilledcheez_21's avatar
      grilledcheez_21
      Icon for Nimbostratus rankNimbostratus
      So interestingly, it seemed to have caused the servers to not connect that I was trying to allow. I'm trying to allow the ones listed in the iRule. Anyway, apparently the servers returned with a bunch of SSL failures.