For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

CGI's avatar
CGI
Icon for Altostratus rankAltostratus
Oct 08, 2010

Modifying irule for geofiltering to include allowed ips

Hi iam new to both F5 and irules, and we are trying to achieve a modification of a exsisting irule that is used for geofiltering.   We would like to combine the possability to include certain ip ad...
application delivery
dev
devops
iRules
Chris_Miller's avatar
Chris_Miller
Icon for Altostratus rankAltostratus
Oct 08, 2010
Good call Hoolio 


when CLIENT_ACCEPTED {
    if {([class match [whereis [IP::client_addr] country] eq allowed_country] or [class match [IP::client_addr] eq allowed_ip])} {
          set allowed 1 }
    else { set allowed 0 }}

when HTTP_REQUEST {
     if { $allowed eq 1 } {
             Uncomment the line below to turn on logging.
            log local0.  "Valid client IP: [IP::client_addr] - forwarding traffic"
            forward }
    else {
       HTTP::respond 403 content "Not Allowed"
         log local0.  "Blocked Country client IP: [IP::client_addr] from [whereis [IP::client_addr] country]" } }

IIRC, I needed the "else set allowed 0" or we'll throw TCL errors...I suppose I could use catch, info exists, or check that the value != ""

Thoughts?