Restrict FTP traffic on VIP to IP address or range

Hi Joe,

If you want to add source IP/subnet restrictions to that iRule you could create an address type datagroup with the allowed IPs/subnets and then add a check in CLIENT_ACCEPTED to see if the client IP is in the datagroup:

when CLIENT_ACCEPTED {

    Check if client IP is not in the allowed_clients_datagroup
   if { not [matchclass [IP::client_addr] equals allowed_clients_datagroup]}{

       Disallowed client IP, send a tcp reset
      reject
   }
}

Aaron