restrict access to a vs by a datagroup but temp allow exceptions and log

value is optional to add description. you can keep it blank. Reject can be commented out until IP address list is confirmed to allow all traffic

when CLIENT_ACCEPTED {
 if { ![class match [IP::client_addr] eq "datagroup_allowed_ip" ] }{
  log local0. "Dropped connection: client IP [IP::client_addr] is not in datagroup."
  #reject
  }
 }

SanjayP gave you a good suggestion but I recommend trying with local traffic policy as it now support data groups and this way is better than using not optimized iRule and it is easier to work with a local traffic policy when possible.

https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-local-traffic-policies-getting-started-13-0-0/1.html

Sanjay's example is good, but as Nikoolayy1 pointed out, this can be done more efficiently with a local traffic policy. Initially, the policy might like this:

(tmos)# list /ltm policy reject_disallowed_ip_addresses
ltm policy reject_disallowed_ip_addresses {
    last-modified 2021-04-10:15:59:01
    requires { tcp }
    rules {
        reject_disallowed_ip_addresses {
            actions {
                0 {
                    log
                    client-accepted
                    write
                    facility local0
                    message "tcl:Dropping connection for client [IP::client_addr] not in datagroup"
                    priority info
                }
            }
            conditions {
                0 {
                    tcp
                    client-accepted
                    address
                    matches
                    datagroup disallowed_ips
                }
            }
        }
    }
    status published
    strategy first-match

When you are ready to actually reject the traffic, change the log action to Reset traffic at client-accepted.

With respect to what the value setting is in a datagroup entry, it is optional and would allow you to associate some value with the key portion of the entry. In your case, you do not need it.

thanks all i got it working, thanks for the very quick replies.