For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Gorf_33479's avatar
Gorf_33479
Icon for Nimbostratus rankNimbostratus
Mar 10, 2011

iRule to filter based on subnet

Greetings all, I have been reading some other forum posts about using iRules to filter client IP's, and I have come across some discussions about how to get subnets to work, but I am still a little lo...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Mar 10, 2011
Hi Gorf,

The switch statement you're using performs a string comparison of the client IP against the addresses. It would be more efficient to use an address type datagroup and 'matchclass' to do this. An address datagroup also supports subnets.

http://devcentral.f5.com/wiki/default.aspx/iRules/matchclass 


when CLIENT_ACCEPTED {
   if { not ([matchclass [IP::client_addr] equals allowed_subnets_class]) } { 
      drop
   }
}

Aaron