Forum Discussion
player_72606
Nimbostratus
Nimbostratusuri by source ip
Hi all,
newbie here :-)
i need help writing iRule to filter uri by source ip :
for uri /web/admin=1 - source ip 1.1.1.1
for uri /web/admin=0 - all others
hen HTTP_REQUEST {
if { [URI::decode [string tolower [HTTP::uri]]] contains "web/admin=1"
}
{
if {[matchclass [IP::remote_addr] equals $::management_ip]
}
{
log local0.info "Allowed client to uri: [IP::remote_addr] requesting: [HTTP::uri]"
}
else
redirect{ [URI::decode [string tolower [HTTP::uri]]] contains "web/admin=0"
{
log local0.info "not web manager: [IP::remote_addr] requesting: [HTTP::uri]"
}
}
what's wrong here?
6 Replies
player_72606missing close brace........- player_72606is this the right way to do this?
- player_72606the ip restrication should be based on the parameter in the uri :
uri - /web/admin.aspx?login=1 permited to source ip 1.1.1.1
uri - /web/admin.aspx?login=2 permited to any source ip
any ideas? 
hoolioCirrostratus
Hi,
Do you want to only allow requests to /web/admin.aspx with a parameter login-1 to a single IP address? What do you want to do if a request is made for this path with login=1 from a disallowed client IP address?
Here is an example to get you started:when HTTP_REQUEST { Check requested path if {[string tolower [URI::decode [HTTP::path]]] eq "/web/admin.aspx"}{ Check login parameter value if {[URI::query [HTTP::uri] "login"] eq "1"}{ Request to restricted resource. Check if client IP is not 1.1.1.1 if {not ([IP::addr [IP::client_addr] equals 1.1.1.1])}{ Take some action to prevent request? Rewrite login=1 to login=2 HTTP::uri [string map {login=1 login=2} [HTTP::uri]] Redirect client to rewritten URI? HTTP::redirect [string map {login=1 login=2} [HTTP::uri]] } } } }
Aaron- player_72606only source ip 1.1.1.1 should be allowed to access =1
all other sources should be discarded,
if source ip 1.1.1.1 requesting to access =0
discard the request. - hoolioTo discard a connection, you can use the discard command. I'm not sure I understand the exact logic you're trying to implement, but hopefully the example I added above will be enough for you to get started. If you run into problems, try adding log statements to the iRule to see what conditions are being met. The log output will be written to /var/log/ltm by default.
Aaron
