For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nick_T1's avatar
Nick_T1
Icon for Nimbostratus rankNimbostratus
Feb 18, 2016

Stripping headers on response depending on client IP

We're looking to strip some internal headers at the bigip if the client IP is not internal. We could do this in iRules, but it seemed like a good use case for a more rigid/optimized policy. Would it ...
iRules
LTM
security
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Feb 18, 2016

Hi Nick,

you may try this iRule as a starting point...

 

when CLIENT_ACCEPTED {
    if { ( [IP::addr [IP::client_addr] equals 10.0.0.0/8] ) or
         ( [IP::addr [IP::client_addr] equals 172.16.0.0/12] ) or
         ( [IP::addr [IP::client_addr] equals 192.168.0.0/16] ) } then {
        set external_client 0
    } else {
        set external_client 1
    }
}
when HTTP_RESPONSE {
    if { $external_client } then {
        HTTP::header remove SILLY_HEADER1
        HTTP::header remove SILLY_HEADER2
        HTTP::header remove SILLY_HEADER3
        HTTP::header remove SILLY_HEADER4
    }
}

 

Note: If you internal Network is more complex, then you may also checkout the [class match] command using IP address based datagroups.

Update: Corrected the code to strip the header for external clients.

Cheers, Kai