Forum Discussion

Jace_45978's avatar
Jace_45978
Icon for Nimbostratus rankNimbostratus
Dec 16, 2015

reject public IP to url allow internal IPs

have a site that needs to reject public access to /abc (allowing internal IPs) but allow public/private access to /abc1 started out with this irule to reject /abc but then realized that /abc1 needs...
iRules
LTM
security
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Dec 17, 2015

Hi Jace,

iRules evalutes your conditions in a first-match order.

So either make sure you'll use a collision free conditions set by using "equals" operators (as Stephan already recommended), or evaluate the most restrictiv "starts_with" condition first and the continue to evaluate the less restrictive "starts_with" condition (see snippet below). 

when HTTP_REQUEST {
    set low_uri [string tolower [HTTP::uri]]
    if { $low_uri starts_with "/abc1" } then {
         Allow the request
    } elseif { ( $low_uri starts_with "/abc" ) and not ( [class match [IP::client_addr] equals private_net] ) } then {
        reject
    }
}

Cheers, Kai