Forum Discussion

Cirrostratus

Jul 30, 2025

SSH proxy implementation

Hi , my scenario is - users need to connect to sftp server - via F5 - F5 has snat so sftp server cannot see real ip of users . i need to implement an allow list of username + client ip on F5 . ...

application delivery

KeesvandenBos

MVP

Aug 02, 2025

Hi,

You can restrict commands per username in the SSH proxy: SSH-Proxy

But it is not possible to restrict a client ip/username combination.

I think you best chance is with an irule and data group, see this example: irule-to-pass-original-client-ip-in-ssh-proxy

Cheers,

Kees

awan_m
Cirrostratus
Aug 07, 2025
Thnaks for the response
Question - once i setup ssh proxy and it has the option to allow commands for users
would i be able to log users - and then i can do a compare from datagroup and allow ip / user connections
- awan_m
  Cirrostratus
  Aug 08, 2025
  i have ssh proxy configured now - and ssh proxy is logging client ip and username
  "ssh_serverside_auth_success","10.10.10.10","puser"
  now the task how can i extract this information and compare it against a data group
  with SSL - there are irule options to extract info with CLIENTSSL_DATA
  how can i extract the username from ssh proxy ?
  thanks