Forum Discussion
Joe_Gorman_4645
Nimbostratus
NimbostratusRestriction of access to URI by IP
So I'm needing to restrict access to 4 URIs by IP Address. I have created the following iRule and Datagroup. At this time, it works for the first URI in the list, but returns a 404 error for the rest of the URIs below. Is there something that I am missing, it looks like it should function normally.
Thanks
class grs_access {
{
network 10.0.0.0/8
host 50.16.227.16
network 172.16.0.0/16
network 192.168.0.0/16
host 204.236.236.43
}
rule grsreg_whitelist {
when HTTP_REQUEST {
switch -glob [string tolower [HTTP::path]] {
"/grda*" {
if {not [matchclass [IP::client_addr] equals grs_access]}{
HTTP::respond 403 content {Blocked!}
}
}
"/grsupport*" {
if {not [matchclass[IP::client_addr] equals grs_access]}{
HTTP::respond 403 content {Blocked!}
}
}
"/grreg*" {
if {not [matchclass[IP::client_addr] equals grs_access]}{
HTTP::respond 403 content {Blocked!}
}
}
"/grrt*" {
if {not [matchclass[IP::client_addr] equals grs_access]}{
HTTP::respond 403 content {Blocked!}
}
}
}
}
}2 Replies
hoolioCirrostratus
Hi Joe,
Are you sure about the 404? The iRule should either send a 403 or send the request to the VS default pool. I don't see how LTM could cause a 404 here either by rewriting the request or selecting the wrong pool.
Though you are missing a space between matchclass and the client IP in the last three switch cases. That should cause a runtime TCL error and TCP reset being sent to the client.
Also, you could combine the four URIs into one switch action like this:when HTTP_REQUEST { switch -glob [string tolower [HTTP::path]] { "/grda*" - "/grsupport*" - "/grreg*" - "/grrt*" { if {not [matchclass [IP::client_addr] equals grs_access]}{ HTTP::respond 403 content {Blocked!} } } } }
Aaron
Joe_Gorman_4645Ah... Geez... The missing space is what did me in. Thank you for the prompt response and for the abridged version of the rule. I wasn't sure if stacking them like that would have the desired effect, but being fairly new to this your wisdom is very appreciated.
Thanks
