For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mr_evil_116524's avatar
mr_evil_116524
Icon for Nimbostratus rankNimbostratus
Dec 15, 2013

Question about iRULE (whitelist port and IP)

Hello Guys, I am trying to write an iRULE for following scenario. We are trying to restrict traffic between shared services and client vLANS. So from client vLAN they can only reach specific por...
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Dec 16, 2013

At the very least you're going to want to use the TCP::local_port command to see port 53 and port 389 traffic. But if I may add, your conditional logic reads like this:

 

  • if the destination address (IP::local_addr) is in a specific subnet (yyy.yyy.yyy.yyy/26)
  • and the client address (IP::client_addr) exactly matches a specific address (yyy.yyy.yyy.yyy)
  • and the requested port is in the TCP data group
  • and the requested port is in the UDP data group

Not sure if this is your intention, but the biggest issues for the above might be:

 

  1. Exactly matching a specific client IP address
  2. Requiring the requested port to be in both data groups