Forum Discussion
rahvee
Cirrus
CirrusResolving DNS, and dynamically selecting pool
The problem: Some LAN hosts are not permitted outbound access to the internet through the firewall, and yet, they need access to github.com. Unfortunately, github's published CIDR ranges are enormous (hundreds of CIDR ranges), and dynamic, so we can't just modify firewall to allow outbound access to a simple set of CIDR ranges. Also, github.com is extremely dynamic. If you resolve over and over, it comes back with a new set of IP addresses every few seconds. So our firewall, which supports DNS-based rules, is not able to support DNS-based rules for github.com. It's just simply too volatile.
The proposed workaround: Host a virtual server as a reverse proxy on a private IP address on the F5, which will use an iRule to query github.com, and TCP pass-thru traffic to whatever external IP address is returned. Local clients would have the F5 IP address hard-coded into /etc/hosts so all traffic for github.com will go to this local F5 IP address, and the F5 should pass-thru to an appropriate external IP for github.com.
The DNS query is easy enough in an iRule. The problem is pool selection. I assume I can't have an iRule dynamically create or modify a pool, right? I should be able to create a pool with a hard-coded set of IP addresses in it, but then it won't be dynamic at all, and we'll be prone to failure whenever github decides to change their IP addresses.
Any good ideas for possible solutions?
Thanks
you can simple create pool member using hostname instead of ip address
- welinton_trigueiro
Create a NODE using the FQDN github.com and adjust the TTL to the desired time.
Associate this NODE with a POOL named github_pool.
Create a reverse-proxy virtual server "vs_github_proxy" of type Performance (Layer 4), associate the POOL in the resources section. Additional settings, such as defining the VLAN for incoming traffic or even a SNAT Pool, can be configured as needed.
If necessary, add an iRule to restrict access to specific URLs within the GitHub domain.
If you do not want to filter the ports, you can create a port list in Shared Objects and associate it with the virtual server.
- zamroni777
Nacreous
you can simple create pool member using hostname instead of ip address
rahveeUsing FQDN Nodes seems to have totally solved it. Thanks! I didn't know of that capability before...
- welinton_trigueiro
Additionally, when you create an FQDN node by adding a pool member, the TTL options are suppressed, and it is created with a default value of 3600 seconds.
Therefore, the best option to solve your problem with the IP change for the host github.com quickly would be to create an FQDN node under "Nodes," as this will give you the option to set the TTL to your preferred time.
If you also want to change the TTL of the FQDN node created through the addition of a pool member, simply access the node and adjust it as you prefer.
I used gitlab.com as an example host.
