Forum Discussion

Joe_Pena's avatar
Joe_Pena
Icon for Nimbostratus rankNimbostratus
Jan 25, 2018

Need to create irule that can redirect a port to another port

we have an application that listens on port80 via the VIP. Once you login to the application it responds with port 9080, 9081, or 9082 and changes the client URL to use one of those ports. Because I do not have a VIP setup to listen on those ports the application fails. Can someone show me how to write an irule that would take an inbound request for ports 9080, 9081, and 9082, and redirect that to port 80?

 

5 Replies

  • why not add virtual servers for those other ports?

     

    it is probably possible to tweak with the port the question is if it is going to work. you can have your client on the front talk with port 80, but in the back the application probably requires responses on those other ports. so why do you want this ?

     

  • I thought about creating the other VS, however the developers are saying we have to remove the port because the initial request is on port80 and the cookie will get assign on that port. If I create the other VS and it goes to port 9081, then the user will need to re-authenticate because the cookie session will be invalid. It's the way the application works, I hate it. If you know how to write the irule that would be awesome.

     

  • for the port part a quick search turns this up

    According to RFC2965 3.3.1 (which might or might not be followed by browsers), unless the port is explicitly specified via the port parameter of the Set-Cookie header, cookies might or might not be sent to any port.
    
    Google's Browser Security Handbook says: by default, cookie scope is limited to all URLs on the current host name - and not bound to port or protocol information. and some lines later There is no way to limit cookies to a single DNS name only [...] likewise, there is no way to limit them to a specific port. (Also, keep in mind, that IE does not factor port numbers into its same-origin policy at all.)
    

    so that isn't the case most likely.

    how does that work when you go normally to the site without a F5, you then also go on different ports right?

    for the irule just search here, tinkering with ports is often requested and with some searching and putting parts together you probably will go something working. personally i still doubt it will be able to do what you want.

  • if we bypass the F5 completely then we have to specify a port "; because that's what the app is listening for. Once we put it in production, clients will connect via the VIP on standard http port number, then the F5 will forward it to the nodes in the pool on port 9080....I tried to get the developers to disable that feature in which the application responds back with a port in the URL causing the clients to make a request on that specific port. They said that's the behavior of the application. I will search around to see how to strip the port number from the response but maintain the URI and hostname intact.

     

  • So your pool member behind the VIP is on port 9080, but it responses with a cookie and redirection to 9080, 9081 or 9082 - is that correct?

     

    And the cookie is specific to the port service that the client is redirected to?

     

    Or do you have three pool members with one IP and listening on port 9080, 9081 and port 9082?

     

    If this is the case, then you use an irule to strip the port out of the pool member responses, and use cookie persistence to ensure that client requests always get sent to back to the same pool member.