Forum Discussion

Emilio_104473's avatar
Emilio_104473
Icon for Nimbostratus rankNimbostratus
Feb 14, 2009

Redirect based on IP within X_FORWARDED_FOR

Hi,

 

I am looking to find the way to redirect requests made to a virtual server to be redirected to a another Pool, based on the IP address within X_forwarded_for header.

 

 

 

Thanks

 

 

Emilio
application delivery
dev
devops
iRules
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Feb 15, 2009
    How about 

     
 when HTTP_REQUEST { 
   if { [HTTP::header "X-Forwarded-For"] == "192.168.5.100" }  {  
     pool uat_pool 
   } else {  
     pool main_pool  
   } 
 }

    hope this helps

    CB

  • Emilio_104473's avatar
    Emilio_104473
    Icon for Nimbostratus rankNimbostratus
    Feb 15, 2009
    That worked. I found another one which utilizes the data groups.

     

     

    when HTTP_REQUEST {

     

    if { [HTTP::header exists "X-Forwarded-For"] } {

     

    set xff [HTTP::header "X-Forwarded-For"]

     

    xff may be in format of addr1,addr2,addr3

     

    set addrs [split $xff ","]

     

    foreach addr $addrs {

     

    if { [matchclass $::banned_addr_list equals $addr] } {

     

    reject

     

    }

     

    }

     

    }

     

    }

     

     

    Thank you,

     

    Emilio
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 16, 2009
    Hi Emilio,

     

     

    An XFF header value (or multiple XFF headers) can be inserted manually by a malicious client. I don't think it would be very bulletproof to depend on this header value to prevent known bad client IP addresses from accessing the VIP. It would be more ideal to filter at the device that sees the original client IP address as the source of the TCP packets.

     

     

    Aaron