Forum Discussion
DanS
Sep 12, 2019Nimbostratus
Restrict Traffic To VIP By Subnet
I would like to restrict a subnet (192.168.1.0/24) from accessing VIP: 10.10.10.10. Is this possible with a irule? I can only find ways on how to restrict traffic from a single IP and not a subnet. A...
- Sep 13, 2019
Just go with a datagroup with Irule method. So that you can add more IP's in the blacklist group on the file. You need not keep editing your irule.
Create a datagroup called blacklist subnet, make sure its type IP.
type: ip
ltm data-group internal blacklist_subnet { records { 20.20.20.0/32 { } 30.30.30.30/25 { } } type ip }
Then create your irule like below,
when CLIENT_ACCEPTED { if { [class match [IP::client_addr] eq blacklist_subnet] } { log local0. "Client IP - [IP::client_addr] is blacklisted. Dropped traffic" drop } }
Faruk_AYDIN
Sep 12, 2019Nimbostratus
use this:
when CLIENT_ACCEPTED {
if { [IP::addr [IP::client_addr]/24 equals 192.168.1.0] } {
drop
}
}
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects