Virtual Server multiple service ports

this is destination port. And I need to accept traffic for 19000 - 20999 and 30000 and 30999, the above I rule will drop all the traffic greater than 18000 and less then 20999. Also for 30000 to 30999

Thanks a lot , I will try tomorrow and let you know. Kamal

Hi,

I like to allow only TCP 80, TCP 443, UDP 500 & UDP 4500 on 0 port Virtual . Is below IRULE configuration right?

when CLIENT_ACCEPTED { Check if requested port is allowing only TCP 443, TCP 80, UDP 4500 and UDP 500 if { ( [TCP::client_port] != 443 or [TCP::client_port] != 80 or [UDP::client_port] != 500 or [UDP::client_port] != 4500 ) } { Drop request drop } }

Thanks

Please add not after if statement

if { not ( [TCP::client_port] != 443 or [TCP::client_port] != 80 or [UDP::client_port] != 500 or [UDP::client_port] != 4500 ) } { Drop request drop } } drop } }

Its works.

Thanks for helping

You can configure one virtual server for all ports but that creates a security vulnerability. Its better to have a virtual server for each application service port you need - that way you are limiting your network exposure to just those known ports.

The other advantage to having multiple virtual servers for each port is it allows you to have better insight as to the health and availability of your application. You will know if a particular component is down or not (HTTPS is up on the web server but the app server is down for instance).

Lastly, each virtual server will have corresponding profiles that can help in logging events. If you're using AVR (which I hope you are) or at least request logging then you can see each transaction as it transverses both the F5 and your application.

Guys,

Is it possible to use a data group list to list the port numbers? i.e. something like the below where Defined_Ports references an integer or string Data Group List?

when CLIENT_ACCEPTED {

if { not ([matchclass [TCP::local_port] equals Defined_Ports]) }{ log local0. "Invalid Port: [TCP::local_port] - discarding" discard } }

i have the ip of a vip and i need to understand on which ltm is this configured. Is using tracert from cmd the only way ?

Guys, I'm hitting my head against a brick wall! I'm trying to allow clients to connect only on ports 443 or 2030 but it's not working - they can connect on any port!?

I've got this iRule:

when CLIENT_ACCEPTED { if { not ([TCP::local_port] == 443) or ([TCP::local_port] == 2030) }{ reject } }

and I've followed the instructions above (same result) as well as K6018 to enable PAT on the vServer (same result); I've even tried 'serverside' and 'clientside' after local_port in the iRule (same result); I've tried drop - same result. I've also tried other iRules from other threads e.g. with words like client_port !=443...

The only time I can't connect on other ports is if I change the service port on the vServer to 443, otherwise, I can always telnet into this vServer on any of the other ports (i.e. the iRule is not working). I've bound the iRule to the vServer in the resources tab (the HTTP > HTTPS redirect worked when I bound it here so I'm thinking this is the right place?). Just to be sure, I made new vServer with no extra settings such as HTTP profile etc. but still, can go straight through. I'm on 13.1.0.8. What am I missing?

Guys, I'm hitting my head against a brick wall! I'm trying to allow clients to connect only on ports 443 or 2030 but it's not working - they can connect on any port!?

I've got this iRule:

when CLIENT_ACCEPTED { if { not ([TCP::local_port] == 443) or ([TCP::local_port] == 2030) }{ reject } }

and I've followed the instructions above (same result) as well as K6018 to enable PAT on the vServer (same result); I've even tried 'serverside' and 'clientside' after local_port in the iRule (same result); I've tried drop - same result. I've also tried other iRules from other threads e.g. with words like client_port !=443...

The only time I can't connect on other ports is if I change the service port on the vServer to 443, otherwise, I can always telnet into this vServer on any of the other ports (i.e. the iRule is not working). I've bound the iRule to the vServer in the resources tab (the HTTP > HTTPS redirect worked when I bound it here so I'm thinking this is the right place?). Just to be sure, I made new vServer with no extra settings such as HTTP profile etc. but still, can go straight through. I'm on 13.1.0.8. What am I missing?