For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mbamusa_59409's avatar
mbamusa_59409
Icon for Nimbostratus rankNimbostratus
Nov 02, 2010

packet filter based on URL

HI ALL ,

 

 

i have a web site published over the internet (ie www.mysite.com)and i want to prevent access to some suburl (ie. www.mysite.com/admin)for this website to be accessed from outside how could i acheve this using eaither packet filtering or irule .

 

 

thank you .

 

application delivery
dev
devops
iRules

3 Replies

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Nov 02, 2010
    Here's an iRule to accomplish it. 

    
when HTTP_REQUEST {
   if { [HTTP::host] eq "www.mysite.com" and [HTTP::uri] starts_with "/admin" and ![class match [IP::client_addr] eq inside_addresses] } {
     discard }}

    This requires that you create an address-type "datagroup" containing the IPs you want to allow. Let me know if you have any issues.
  • mbamusa_59409's avatar
    mbamusa_59409
    Icon for Nimbostratus rankNimbostratus
    Nov 03, 2010
    hi chris

     

     

    thank you for your kind replay

     

     

     

    let's assume that 192.168.1.0/24 is the subnet which i want them to access the link and discard evrey thing else who we could write this ?

     

     

    and what if the link is not like www.mysite.com/admin and it's like www.admin.mysite.com ?

     

     

    regards
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Nov 03, 2010
    This should work. 

    
when HTTP_REQUEST {
   if { [HTTP::host] eq "www.admin.mysite.com" and ![IP::addr [IP::client_addr]/24 eq 192.168.1.0] } {
     discard }}

    Let me know if it doesn't.