F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Bastien_124165's avatar
Bastien_124165
Icon for Nimbostratus rankNimbostratus
Oct 27, 2016

iRule to blocked established connection

I have an iRule to blocked range of IP, but it's using the event CLIENT_ACCEPTED. I'm trying to do the same against established connections, eg. I want to block an attack from an IP.   I've seen t...
iRules
LTM
security
cjunior's avatar
cjunior
Icon for Nacreous rankNacreous
Oct 27, 2016

Hi,

I think that in the link shared is missing TCP::collect within CLIENT_ACCEPTED event. So, as a first shot, I think you may try to put the statement. e.g.

when CLIENT_ACCEPTED {
  log local0. "\[class get blacklist\]=[class get blacklist]"
  TCP::collect
}

I hope it helps.

Related Content