Virtual Server multiple service ports

Guys, I'm hitting my head against a brick wall! I'm trying to allow clients to connect only on ports 443 or 2030 but it's not working - they can connect on any port!?

I've got this iRule:

when CLIENT_ACCEPTED { if { not ([TCP::local_port] == 443) or ([TCP::local_port] == 2030) }{ reject } }

and I've followed the instructions above (same result) as well as K6018 to enable PAT on the vServer (same result); I've even tried 'serverside' and 'clientside' after local_port in the iRule (same result); I've tried drop - same result. I've also tried other iRules from other threads e.g. with words like client_port !=443...

The only time I can't connect on other ports is if I change the service port on the vServer to 443, otherwise, I can always telnet into this vServer on any of the other ports (i.e. the iRule is not working). I've bound the iRule to the vServer in the resources tab (the HTTP > HTTPS redirect worked when I bound it here so I'm thinking this is the right place?). Just to be sure, I made new vServer with no extra settings such as HTTP profile etc. but still, can go straight through. I'm on 13.1.0.8. What am I missing?

Guys, I'm hitting my head against a brick wall! I'm trying to allow clients to connect only on ports 443 or 2030 but it's not working - they can connect on any port!?

I've got this iRule:

when CLIENT_ACCEPTED { if { not ([TCP::local_port] == 443) or ([TCP::local_port] == 2030) }{ reject } }

and I've followed the instructions above (same result) as well as K6018 to enable PAT on the vServer (same result); I've even tried 'serverside' and 'clientside' after local_port in the iRule (same result); I've tried drop - same result. I've also tried other iRules from other threads e.g. with words like client_port !=443...

The only time I can't connect on other ports is if I change the service port on the vServer to 443, otherwise, I can always telnet into this vServer on any of the other ports (i.e. the iRule is not working). I've bound the iRule to the vServer in the resources tab (the HTTP > HTTPS redirect worked when I bound it here so I'm thinking this is the right place?). Just to be sure, I made new vServer with no extra settings such as HTTP profile etc. but still, can go straight through. I'm on 13.1.0.8. What am I missing?

Thanks for your help - same result - it's almost as though no iRules are being applied to this vServer...

What makes you to go to irule , instead of creating simple Virtual listening on port 443 and 2030. if possible can you paste configs

Because of this: https://devcentral.f5.com/codeshare?sid=560 - I'm adapting that principle to my problem - which is a long story - but, it looks like if I can't formulate/find an iRule that's up to the task, then I'll resort to individual vServers which is also best practice for a number of reasons anyway.

Because of this: https://devcentral.f5.com/codeshare?sid=560 - I'm adapting that principle to my problem - which is a long story - but, it looks like if I can't formulate/find an iRule that's up to the task, then I'll resort to individual vServers which is also best practice for a number of reasons anyway.

All, I'm attempting to do something similar using an Rule with and a datagroup. We have 4 proxy servers that listen on a myriad of ports. Today I have a bunch of fastl4 VIPs/Pools for each port that the proxies support (Example SSH_VS 10.10.10:22 and SSH_Pool 10.20.10.20:22, 10.20.10.21:22, 10.20.10.23:22, 10.20.10.24:22). I'd like to simplify and make it easy to expand. I'm testing setting up a wildcard VIP that has ports restricted using an iRule/Datagroup. I would also like to have a wildcard pool that contains the 4 proxies. The idea being that a user connects over a port and the VIP will pass the port straight to the proxy. Outside of the items listed in, https://support.f5.com/csp/article/K6018 is there anything other considerations for me to make seeing as these are proxy servers and not your typical web servers?

DG
ltm data-group internal /Common/DMZ-LAN-Port-DG {
    records {
        FTPS_22 {
            data 22
        }
        FTP_21 {
            data 21
        }
        HTTPS_443 {
            data 443
        }
        HTTP_80 {
            data 80
        }
    }
    type string
}
 
iRule
when CLIENT_ACCEPTED {
  set lport [TCP::local_port]
   if {! [class match -value $lport equal "DMZ-LAN-Port-DG" ] } {
         log local0. "Local Port:$lport not found in Data Group."
      }\
   elseif { [class match -value $lport eq "DMZ-LAN-Port-DG" ] }{
     #Traffic is allowed. Port match found in DMZ-LAN-Port-DG
    return
  } else {
     #Traffic is dropped. Port match not found in DMZ-LAN-Port-DG
    drop
  }
}
}