Forum Discussion

Sumanta_88744's avatar
Sumanta_88744
Icon for Cirrus rankCirrus
Jun 11, 2016

Universal Persistence with X-forwarder

Hi Experts   Can I use Universal persistence using x-forwarder with i-rule? I would have each x-forwarded IP stick to the same back-end pool member. Will this work? Can you please share code? Any ...
application delivery
cloud
iRules
LTM
  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Jul 20, 2016

    A formatted version of the "Per VS" rate limiting. You can apply the same irule to all standard VS using UIE persistence.

     

    when RULE_INIT {
    set static::maxReqs 3;
    set static::timeout 60;
}

when HTTP_REQUEST {
        set vs [URI::basename [virtual]]
        if { [HTTP::header exists "X-Forwarded-For"] } {
            set client_IP_addr [getfield [lindex  [HTTP::header values "X-Forwarded-For"]  0] "," 1]
        } else {
            set client_IP_addr [IP::client_addr]
        }
        if { ([HTTP::method] eq "GET") and ([class match [string tolower [HTTP::uri]] ends_with $vs_URI_LIST_TO_LIMIT] ) } {

            whitelist
            if { [class match [IP::client_addr] equals $vs_ips_whitelist] }{
               return
            }
            set getcount [table lookup -notouch "$vs_$client_IP_addr:[HTTP::uri]"]
            if { $getcount equals "" } {
                table set "$vs_$client_IP_addr:[HTTP::uri]" "1" $static::timeout $static::timeout
            } else {
                if { $getcount < $static::maxReqs } {
                    table incr -notouch "$vs_$client_IP_addr:[HTTP::uri]"
                } else {
                    reject
                }
            }
        }
        persist uie $clientip 
}

when HTTP_RESPONSE { 
    persist add uie $clientip 
}

     

Sumanta_88744's avatar
Sumanta_88744
Icon for Cirrus rankCirrus

Hi Yann

 

What about this one? Is it same as your code logic or different?

 

From http://devcentral.f5.com/wiki/iRules.table.ashx

 

Limit each client IP address to 20K concurrent connections

 

when CLIENT_ACCEPTED {

 Max connections per client IP

set limit 20000 

 Set a subtable name with a standard prefix and the client IP

set tbl "connlimit:[IP::client_addr]"

 Use a key of the client IP:port

set key "[IP::client_addr][TCP::client_port]"

 Check if the subtable has over X entries

if { [table keys -subtable $tbl -count] >= $limit } {

  log local0. "[IP::client_addr]:[TCP::client_port]: Rejecting connection ([table keys 

  -subtable $tbl -count] connections / limit: $limit)"

  reject

} 

else {


    Add the client IP:port to the client IP-specific subtable 

      with a max lifetime of 1260 seconds (30min), matched with L4 profile

   table set -subtable $tbl $key "ignored" 1260

   log local0. "[IP::client_addr]:[TCP::client_port]: Allowing connection ([table keys 

    -subtable $tbl -count] connections / limit: $limit)"

}

}

 when CLIENT_CLOSED {

 When the client connection is closed, remove the table entry

 table delete -subtable $tbl $key

 log local0. "[IP::client_addr]:[TCP::client_port]: Decrementing ([table keys -subtable $tbl 
 -count] connections / limit: $limit)"


}
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Aug 17, 2016

The iRule you have just tested allows "20000" connection establishments for each single TCP::client_port of a given [IP::client_addr] in a specific timeframe. Once the block has happend it block each TCP::client_port individually...

Note: See the iRule posted a few minutes ago, to get a TCP connection or HTTP request based rate limiter as needed...

Cheers, Kai