Forum Discussion

Vshah's avatar
Vshah
Icon for Nimbostratus rankNimbostratus
Oct 10, 2024

Irule to allow specific IPs

I have a site which is abc.com
Trying to achieve below requirements-
1) If uri is / it should redirect to abc.com/xyz - open for all
2) If uri is /rdp_xyz_tshoot should accessible to internal network - (here we can use the datagroup list)

As this site is migrated to akamai where they have requirement to use below irule-
when HTTP_REQUEST { 
    if { [HTTP::header exists True-Client-IP] } {
        set trueclientip [HTTP::header True-Client-IP]
        HTTP::header replace X-Forwarded-For $trueclientip
    }
}

Cause for above akamai irule=
Normally the True-Client-IP header includes the real IP of the clients when requests are coming from Akamai. 
It will be unaffected and be sent as part of the request to the pool member. So, your backend servers could look for that header and do something with
its value. However, if you want the F5 to translate it to the X-Forwarded-For header, 
you can use an iRule to convert the Akamai True-Client-IP header to the X-Forwarded-For header.

we are trying with below irule which is not working-
when HTTP_REQUEST {

if { ([HTTP::uri] starts_with "/rdp_xyz_tshoot") && (not[class match [IP::client_addr] equals allowed_IPs])}
{ reject }

if { [HTTP::uri] == "/"  } 
 {
      HTTP::redirect "https://[HTTP::host]/abc_login.jsp"
   }

}


Please help

  • in tcl "==" is for number comparison.
    for text/string, use "eq"

    you should also check /var/log/ltm to see some details of irules error.