Forum Discussion

Nimbostratus

Jan 11, 2018

Need to allow certain IP address to F5 VIP.

I need to restric F5 VIP to allow certain IP addresses.It appear I need to create datagroup ( allowed-nets) from F5 GUi with allow list of ip addresses. does below iRule works as is? when CLIEN...

Employee

Jan 13, 2018

does below iRule works as is?

it looks okay to me.

swjo_264656
Cirrostratus
Jan 13, 2018
I`ve using that kinds of rule.

you should check before apply to VS.

In that data-group list, should contain client side and server side IP or network.

take care.
swjo_264656
Cirrostratus
Jan 13, 2018
I`m using two rules, for forwarding and VIP service.

rule forward_allow when CLIENT_ACCEPTED { if {[class match [IP::client_addr] equals forward_white_list]}{

log local0. "[IP::remote_addr]:[TCP::remote_port] Dst [IP::local_addr]:[TCP::local_port] -> Allowed"
} else { reject log local0. "[IP::remote_addr]:[TCP::remote_port] Dst [IP::local_addr]:[TCP::local_port] -> Denied" } }

rule vip_allow when CLIENT_ACCEPTED { if {[class match [IP::remote_addr] equals vip_white_list]}{

log local0. "[IP::remote_addr]:[TCP::remote_port] Dst [IP::local_addr]:[TCP::local_port] -> Allowed"
LB::server pool } else { reject log local0. "[IP::remote_addr]:[TCP::remote_port] Dst [IP::local_addr]:[TCP::local_port] -> Denied" } }

please refer to it.