Need iRule for specfic sources to specfic ports going to the Same VS for Proxy LB

Key vlaue

443:10.0.1.2 “”

443:11.1.1.4 “”

443:12.1.1.4 “”

8080:12.0.1.2 “”

8080:13.1.1.4 “”

8080:14.1.1.4 “”

Internal class:

class port_to_IP_whitelist {

{

"443:10.0.1.2" { "" }

"443:11.0.1.3" { "" }

"8080:10.0.1.2" { "" }

"8080:11.0.1.3" { "" }

"8081:14.0.1.2" { "" }

"8081:15.0.1.3" { "" }

}

}

External class:

Create file as below:

File saved here:

/config/port_to_IP_whitelist.dat:

Contents of file:

"443:10.0.1.2" := "",

"443:11.0.1.2" := "",

"8080:12.0.1.2" := "",

"8080:13.0.1.2" := "",

"8081:14.0.1.2" := "",

"8081:15.0.1.2" := "",

Configure external class vai GUI, the following shows in the config file:

class port_to_IP_whitelist {

type string

filename port_to_IP_whitelist.dat

}

Here is the irule which matches that design:

When CLIENT_ACCEPTED {

set search_key [TCP::local_port]:[IP::client_addr]

if { not ( [class lookup $search_key port_to_IP_whitelist]) } {

log local0. "Search key $search_key not in whitelist Rejecting connection."

discard

event disable all

return

}

}

class fw_icmp_rules_class {
   {
      network 10.10.14.0/24 {"8.8.8.8:8,4.2.2.2:8,4.2.2.1:8"}
      network 10.11.14.0/24 {"4.2.2.4:8,4.2.2.3:8,4.2.2.2:8,4.2.2.1:8"}
      network 10.12.14.0/24 {"203.8.183.1:8"}
   }
}
class fw_tcp_rules_class {
   {
      network 10.10.14.0/24 { "63.166.98.107:80,1.2.3.4:80,1.2.3.4:443" }
      network 10.11.14.0/24 { "63.166.98.107:80,1.2.3.4:80,1.2.3.4:443" }
   }
}
class fw_udp_rules_class {
   {
      network 10.10.14.0/24 { "4.2.2.1:53,4.2.2.2:53,4.2.2.3:53" }
      network 10.11.14.0/24 { "8.8.8.8:53,4.2.2.1:53,4.2.2.2:53,4.2.2.3:53" }
   }
}

when RULE_INIT {
    Log debug to /var/log/ltm? 1=yes, 0=no
   set static::fw_debug 1
}
when CLIENT_ACCEPTED {
   if {$static::fw_debug}{log local0. "[IP::client_addr]:[TCP::client_port]: destination:\
      [IP::local_addr]:[TCP::local_port]"}
    Check the requested protocol (defined in /etc/protocols)
   switch [IP::protocol] {
      1 {
          ICMP
         set proto icmp
      }
      6 {
          TCP
         set proto tcp
      }
      17 {
          UDP
         set proto udp
      }
      default {
          Unmatched protocol
         if {$static::fw_debug}{log local0. "[IP::client_addr]:[TCP::client_port]: Disallowed protocol"}
          Drop?
         drop
          Reject?
         reject
          Exit this event in this rule
         return
      }
   }
   if {$static::fw_debug}{log local0. "[IP::client_addr]:[TCP::client_port]: Protocol: $proto"}
    If we are still in the rule the protocol matched our allowed list
    Check if the corresponding datagroup exists
   if {not [class exists fw_${proto}_rules_class]}{
       Datagroup does not exist!
      log local0. "[IP::client_addr]:[TCP::client_port]: Datagroup fw_${proto}_rules_class does not exist\
         for lookup to [IP::local_addr]:[TCP::local_port]!"
       Drop?
      drop
       Reject?
      reject
   }
    Do the datagroup lookup against the protocol specific datagroup 
    which maps source networks/hosts to allowed destination host:ports
   set allowed_dest_list [split [class match -value [IP::client_addr] equals fw_${proto}_rules_class] ","]
   if {$allowed_dest_list ne ""}{
      if {[matchclass "[IP::local_addr]:[TCP::local_port]" equals $allowed_dest_list]}{
          Destination host:port is allowed
         if {$static::fw_debug}{log local0. "[IP::client_addr]:[TCP::client_port]: Allowing connection"}
      } else {
          Destination host:port is not allowed
         if {$static::fw_debug}{log local0. "[IP::client_addr]:[TCP::client_port]: Blocking connection"}
          Drop?
         drop
          Reject?
         reject
      }
   }
}

It posted twice!

another double post :-(