Forum Discussion

Ashu_Aggarwal's avatar
Ashu_Aggarwal
Icon for Cirrus rankCirrus
Sep 18, 2020

Restrict access to VS by ip & time

I have to restrict access to a VS by IP & time. So during a particular window (time/day) only specific ip ranges should be allowed to access that vs. Can someone please guide how to do that on a LTM....
application delivery
iRules
LTM
Enes_Afsin_Al's avatar
Enes_Afsin_Al
Icon for MVP rankMVP
Sep 18, 2020

Hi Ashu Aggarwal,

Create a datagroup for always allowed IPs.

Try this iRule:

when RULE_INIT {
	array set static::timerange { #change time
		Monday {"08:30" "20:00"}
		Tuesday {"08:30" "20:00"}
		Wednesday {"08:30" "20:00"}
		Thursday {"08:30" "20:00"}
		Friday {"08:30" "20:00"}
		Saturday {}
		Sunday {}
	}
}
 
when HTTP_REQUEST {
	if { not [class match [IP::client_addr] equals dg-allowed-ip-list-name] } { #change dg name
		set now [clock seconds]
		set current_day [clock format $now -format {%A}]
		set start [lindex $static::timerange($current_day) 0]
		set end [lindex $static::timerange($current_day) 1]
		
		if { ($start ne "") && ($end ne "") && ($now >= [clock scan $start]) && ($now < [clock scan $end]) } {
			set denied 0
		} else {
			set denied 1
		}
		
		unset start end
	} else {
		set denied 0
	}
 
	if { $denied } {
		drop
	}
}
  • Ashu_Aggarwal's avatar
    Ashu_Aggarwal
    Icon for Cirrus rankCirrus
    Oct 14, 2020

     : I got the permission to try this i-rule tonight. Just quick question, from where this i-rule will pick the clock/time? Would it pick the time from system clock?

    Thanks

    • Enes_Afsin_Al's avatar
      Enes_Afsin_Al
      Icon for MVP rankMVP
      Oct 14, 2020

      Hi,

      I test it with this iRule.

      when HTTP_REQUEST {
    log local0. [clock seconds]
}

      Current time log:

      Oct 14 18:11:10 f5 info tmm[18620]: Rule /Common/test_seconds <HTTP_REQUEST>: 1602688267
Oct 14 18:11:10 f5 info tmm[18620]: Rule /Common/test_seconds <HTTP_REQUEST>: 1602688270
...

      after change F5 System Time:

      May 11 21:11:18 f5 info tmm2[18620]: Rule /Common/test_seconds <HTTP_REQUEST>: 1526062278
May 11 21:11:18 f5 info tmm2[18620]: Rule /Common/test_seconds <HTTP_REQUEST>: 1526062298
...

      iRule uses system time.

    • Ashu_Aggarwal's avatar
      Ashu_Aggarwal
      Icon for Cirrus rankCirrus
      Oct 14, 2020

      I hope i am not eating a lot of your time. But how to read it '1526062298'?

      Thanks

    • Enes_Afsin_Al's avatar
      Enes_Afsin_Al
      Icon for MVP rankMVP
      Oct 14, 2020

      clock seconds

      Returns the current time as an integer number of seconds.

       

      An integer value passed to the clock command that represents an absolute time as a number of seconds from the epoch time of 1 January 1970, 00:00 UTC. Note that the count of seconds does not include any leap seconds; seconds are counted as if each UTC day has exactly 86400 seconds. Tcl responds to leap seconds by speeding or slowing its clock by a tiny fraction for some minutes until it is back in sync with UTC; its data model does not represent minutes that have 59 or 61 seconds.

       

      REF: https://www.tcl.tk/man/tcl8.6/TclCmd/clock.htm#M11