Forum Discussion
Universal Persistence with X-forwarder
- Jul 20, 2016
A formatted version of the "Per VS" rate limiting. You can apply the same irule to all standard VS using UIE persistence.
when RULE_INIT { set static::maxReqs 3; set static::timeout 60; } when HTTP_REQUEST { set vs [URI::basename [virtual]] if { [HTTP::header exists "X-Forwarded-For"] } { set client_IP_addr [getfield [lindex [HTTP::header values "X-Forwarded-For"] 0] "," 1] } else { set client_IP_addr [IP::client_addr] } if { ([HTTP::method] eq "GET") and ([class match [string tolower [HTTP::uri]] ends_with $vs_URI_LIST_TO_LIMIT] ) } { whitelist if { [class match [IP::client_addr] equals $vs_ips_whitelist] }{ return } set getcount [table lookup -notouch "$vs_$client_IP_addr:[HTTP::uri]"] if { $getcount equals "" } { table set "$vs_$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout } else { if { $getcount < $static::maxReqs } { table incr -notouch "$vs_$client_IP_addr:[HTTP::uri]" } else { reject } } } persist uie $clientip } when HTTP_RESPONSE { persist add uie $clientip }
A formatted version of the "Per VS" rate limiting. You can apply the same irule to all standard VS using UIE persistence.
when RULE_INIT {
set static::maxReqs 3;
set static::timeout 60;
}
when HTTP_REQUEST {
set vs [URI::basename [virtual]]
if { [HTTP::header exists "X-Forwarded-For"] } {
set client_IP_addr [getfield [lindex [HTTP::header values "X-Forwarded-For"] 0] "," 1]
} else {
set client_IP_addr [IP::client_addr]
}
if { ([HTTP::method] eq "GET") and ([class match [string tolower [HTTP::uri]] ends_with $vs_URI_LIST_TO_LIMIT] ) } {
whitelist
if { [class match [IP::client_addr] equals $vs_ips_whitelist] }{
return
}
set getcount [table lookup -notouch "$vs_$client_IP_addr:[HTTP::uri]"]
if { $getcount equals "" } {
table set "$vs_$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout
} else {
if { $getcount < $static::maxReqs } {
table incr -notouch "$vs_$client_IP_addr:[HTTP::uri]"
} else {
reject
}
}
}
persist uie $clientip
}
when HTTP_RESPONSE {
persist add uie $clientip
}
- Sumanta_88744Jul 21, 2016Cirrus
Hi Yann
Thanks a lot. Should I use this i-rule and add it to standard VS settings or just modify the existing i-rule under persistence profile?
I think I am confused with this one. Since the purpose of i-rule under Persistence profile is different from normal i-rule under vs.
- Yann_Desmarest_Jul 21, 2016Nacreous
Hi,
You should assign this irule to the VS directly. There is no need to assign an Universal persistence profile in this scenario.
Here an extract from the doc : Note: The following persistence methods require a corresponding persistence profile be added to the virtual server: ssl, msrdp, cookie
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com