Jorge_48257
Apr 22, 2011Nimbostratus
iRule to drop port request
I've also tried the following with no success.
I've also tried the following with no success.
what service port is virtual server listening? is it any port?
> The first irule is the only that gives me that error I posted.
this irule doesn't give me an error in irule editor and when running b load.
when CLIENT_ACCEPTED {
if {[TCP::local_port] != 110} {
drop
}
}
virtual EXCH-CAS_RPC_vs {
pool EXCH-RPC_pool
destination 10.10.10.10:any
ip protocol tcp
persist exch_rpc_persist
profiles {
tcp-lan-optimized {
serverside
}
tcp-wan-optimized {
clientside
}
}
}
This is used for Exchange RPC but do not want it to listen on unsecured POP and IMAP. That's why we want to block TCP/110 and TCP/143.
sol7559: Overview of the TCP profile
http://support.f5.com/kb/en-us/solutions/public/7000/500/sol7559.html
i used reject instead of drop since i'd like to see error when connecting to port 22.
virtual bar {
snat automap
pool foo
destination 172.28.17.33:any
ip protocol tcp
rules myrule
profiles mytcp {}
}
pool foo {
members 10.10.70.110:any {}
}
rule myrule {
when CLIENT_ACCEPTED {
if {[TCP::local_port] == 22} {
reject
}
}
}
profile tcp mytcp {
defaults from tcp
verified accept enable
}
ssh 172.28.17.33
ssh: connect to host 172.28.17.33 port 22: Connection refused