Forum Discussion

DarkSideOfTheQ_'s avatar
DarkSideOfTheQ_
Icon for Nimbostratus rankNimbostratus
Sep 16, 2009

Restrict access based off source network

Hello All, Sanity check...I'm trying to block access to specific pages based off the source network the client is coming from. The rest of the site should remain available to anyone. I *think...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Sep 17, 2009
You could add more logging to find out what's happening: 

 
 when HTTP_REQUEST {   
  
    log local0. "[IP::client_addr]:[TCP::local_port]: Request to [HTTP::uri]" 
  
    if {  ([HTTP::uri] contains "Test.jsp") or ([HTTP::uri] contains "Stats.jsp") and not ([matchclass [IP::client_addr] equals $::ips_internal]) } { 
       log local0. "[IP::client_addr]:[TCP::local_port]: Discarding request to [HTTP::uri]" 
       discard 
    } 
 }

Also, as CB pointed out, you should remove the square braces around the datagroup name. That would probably trigger a runtime TCL error as you'd be trying to execute the contents of the class. If that still doesn't work, you could break up the URI and IP address checks into separate if statements with more logging.

Aaron