For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mobile_support_'s avatar
mobile_support_
Icon for Nimbostratus rankNimbostratus
Jun 18, 2014

irule to block a domain using UCP payload

Hi, we are trying to filter some DNS quueries in our bigIP, but face some problems - running version is 10.1 - only LTM license   that means we can not use DNS irules statements, so we though abou...
application delivery
deployment
devops
dns
iRules
LTM
security
The_Bhattman's avatar
The_Bhattman
Icon for Nimbostratus rankNimbostratus
Jun 22, 2014

I ran into the same issue. Here is something that might work.

It was taken from

https://devcentral.f5.com/wiki/iRules.fast_DNS.ashx

when CLIENT_ACCEPTED {
    binary scan [UDP::payload] H4@12A*@12H* id dname question
     set dname [string tolower [getfield $dname \x00 1 ] ]
    switch -glob $dname {
       "\x03www\x06google\x03com" {
          log local0. "This matches www.google.com"
          drop
       }
   }   
}

I hope this helps

-=Bhattman=-