DanS
Sep 12, 2019Nimbostratus
Restrict Traffic To VIP By Subnet
I would like to restrict a subnet (192.168.1.0/24) from accessing VIP: 10.10.10.10. Is this possible with a irule? I can only find ways on how to restrict traffic from a single IP and not a subnet. Any help would be appreciated.
Thanks
Dan
Just go with a datagroup with Irule method. So that you can add more IP's in the blacklist group on the file. You need not keep editing your irule.
Create a datagroup called blacklist subnet, make sure its type IP.
type: ip
ltm data-group internal blacklist_subnet { records { 20.20.20.0/32 { } 30.30.30.30/25 { } } type ip }
Then create your irule like below,
when CLIENT_ACCEPTED { if { [class match [IP::client_addr] eq blacklist_subnet] } { log local0. "Client IP - [IP::client_addr] is blacklisted. Dropped traffic" drop } }