Is there a way for an iRule to restrict access to an URI based on IP address? I would like UNRESTRICTED access to: https://qa.ipcws.fiserv.com I would like to RESTRICT access by IP address to: https://qa.ipcws.fiserv.com/testAPI.aspx

With an IIS-based application, it's particularly difficult to handle all of the different encoding attacks in an iRule that a malicious user could send in the URI. See this post for some example iRules and sample obfuscation methods: http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&tpage=1&view=topic&postid=30900 Aaron

Where do I define the variable for the white list of allowable IP addresses?

You can define the IP addresses or subnets in a datagroup of type: address in the GUI under Local Traffic >> iRules >> Datagroup List. If you're on 9.4.4 or higher, you should reference the datagroup name without the $:: prefix in older examples to allow for CMP compatibility. Aaron

So, would I just call the data group (testapiAllowList) by name like this? when HTTP_REQUEST { if { [matchclass [string tolower [HTTP::path]] contains '/testapi.aspx'] } { if { !([matchclass [IP::client_addr] equals testapiAllowList])} { discard } else { } }

That's close. Here's something to try: when HTTP_REQUEST { if { [string tolower [HTTP::path]] contains "/testapi.aspx" } { if { !([matchclass [IP::client_addr] equals testapiAllowList])} { discard } } } Aaron

Restricting Access to URI Based on IP Address

21 Replies

Lornz_118797
Nimbostratus
Apr 24, 2013
I'm trying to do similar, with (I think) an understanding that f5 recommends not using data groups in a multiprocessor system. So I'm trying to do this:

when HTTP_REQUEST {

switch -glob [HTTP::uri] {

"/healthcheck" {

if { not (([IP::client_addr] equals 10.0.0.0/8) || ([IP::client_addr] equals 172.16.0.0/12) || ([IP::client_addr] equals 192.168.0.0/24)) } {

HTTP::respond 403 content {Blocked!}

}

}

}

}

BigIP is protesting with this though:

01070151:3: Rule [block_public_healthcheck] error: line 4: [parse error: PARSE syntax 128 {syntax error in expression " not (([IP::client_addr] equals 10.0.0.0/8) || ([IP::client_...": looking for close parenthesis}] [{ not (([IP::client_addr] equals 10.0.0.0/8) || ([IP::client_addr] equals 172.16.0.0/12) || ([IP::client_addr] equals 192.168.0.0/24)) }]

and I can't tell if it's because I'm actually using incorrect language, as I'm not seeing a missed close paren. Thanks!
Kevin_Stewart
Employee
Apr 24, 2013
So first things first, I can't imagine anyone suggesting that data groups aren't recommended in multiprocessor systems. They work perfectly well and in many cases simplify your iRules. In any case, here's a slight modification of your conditional.

if { not ( ( [IP:: addr [IP::client_addr] equals 10.0.0.0/8] ) or ( [IP::addr [IP::client_addr] equals 172.16.0.0/12] ) or [IP::addr [IP::client_addr] equals 192.168.0.0/24] ) ) } {
Christopher_Boo
Cirrostratus
Apr 24, 2013
I've had a similar irule (using data groups) in place for months with no issues on a 3600.
Lornz_118797
Nimbostratus
Apr 25, 2013
Hi Kevin- Thanks a bunch, this at least got me to save, and testing now. I'll follow up with f5 to see if we can jettison the understanding that our team got before about the data groups. Thanks again!
Lornz_118797
Nimbostratus
Apr 25, 2013
Hi Christopher- thanks a lot for this information, too. I'm following up here and with f5 to see where this idea came from, and if we can ignore it. Regards, Lorenz
Colin_Walker_12
Historic F5 Account
Apr 26, 2013
I can say with absolute certainty that data groups are very much recommended on multi-processor systems. They work great, and we use them all the time. ;)

Colin
nullck_120095
Nimbostratus
Sep 17, 2013
Hi,

I resolved this problem, then use

when HTTP_REQUEST { switch -glob [IP::client_addr] { "200.34.20.0/20" { set status "OK" } "172.16.0.0/16" { set status "OK" } "10.0.0.0/8" { set status "OK" } } if { $status != "OK" } { if { [HTTP::uri] matches "/admin/" or [HTTP::uri] matches "/administrator/" or [HTTP::uri] matches "/administracao/*" } { HTTP::redirect http://[HTTP::host] } } }
Viv_Richards
Cirrostratus
Jul 19, 2017
Dear All,

I have tried below iRule with the intension to access specific URI (testapi.apsx) from specific IP which is part of testapiAllowList datagroup , however when I am trying to access URI (testapi.aspx), it is still accessible from the IP which is not part of testapiAllowList datagroup

======================= when HTTP_REQUEST { if { [string tolower [HTTP::path]] contains "/testapi.aspx" } { if { !([matchclass [IP::client_addr] equals testapiAllowList])} { discard }

==========

As per my understanding, if I am not part of testapiAllowList datagroup, I should not able to access URI "/tetsapi.aspx"

Kindly correct me if I am wrong
- Kevin_Stewart
  Employee
  Jul 19, 2017
  The logic here seems sound. What does your data group look like?
  
  Maybe add some logging to see what's going on.
  
  when HTTP_REQUEST { if { [string tolower [HTTP::path]] contains "/testapi.aspx" } { if { !([matchclass [IP::client_addr] equals testapiAllowList]) } { log local0. "discarding" discard } else { log local0. "allowing" } } else { log local0. "something else" } }
Martins_K_20579
Nimbostratus
Jul 19, 2017
Dear All,

I have tried below iRule with the intension to access specific URI (testapi.apsx) from specific IP which is part of testapiAllowList datagroup , however when I am trying to access URI (testapi.aspx), it is still accessible from the IP which is not part of testapiAllowList datagroup

======================= when HTTP_REQUEST { if { [string tolower [HTTP::path]] contains "/testapi.aspx" } { if { !([matchclass [IP::client_addr] equals testapiAllowList])} { discard }

==========

As per my understanding, if I am not part of testapiAllowList datagroup, I should not able to access URI "/tetsapi.aspx"

Kindly correct me if I am wrong
- Kevin_Stewart
  Employee
  Jul 19, 2017
  The logic here seems sound. What does your data group look like?
  
  Maybe add some logging to see what's going on.
  
  when HTTP_REQUEST { if { [string tolower [HTTP::path]] contains "/testapi.aspx" } { if { !([matchclass [IP::client_addr] equals testapiAllowList]) } { log local0. "discarding" discard } else { log local0. "allowing" } } else { log local0. "something else" } }