Whitelist a iRule, otherwise redirect

So if you are in the whitelist, allow access to the Virtual server. If you are not in the whitelist, redirect.

smiley_dba,

 

 

As I've learned recently, in this type of case it's simpler (and a shorter irule) to use Not. So, if you're not in the whitelist redirect. This is because a similar post came up very recently (https://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/50/aft/2163192/showtab/groupforums/Default.aspx).

 

 

Also, not sure what version you're running but know that matchlass was deprecated in v10 by class match. Two examples below.

 

 

v9.x

 

 

when HTTP_REQUEST {

 

if {not ([matchclass [IP::remote_addr] equals $::Whitelist_Sorry]) } {

 

HTTP::redirect "http://sorry.********.ca/"

 

}

 

}

 

 

v10.x

 

 

when HTTP_REQUEST {

 

if {not ([class match [IP::remote_addr] equals Whitelist_Sorry]) } {

 

HTTP::redirect "http://sorry.********.ca/"

 

}

 

}

 

 

Hope these work for you.

 

 

N

Thanks Nathan. Having an issue with the Whitelist_Sorry subnets trying to NOT get the redirect, as they are getting the redirect with everyone else.

What does your data group format look like?

 class Whitelist_Sorry {
   {
      host 10.10.5.139
      network 172.16.0.0/16
   }
}

So I added my own IP address to the except list so that I can browse the website, but instead I get a redirect.

To avoid a problem with context could you try IP::client_addr instead of remote_addr?

If you're on 9.4.4 or higher make sure to remove the $:: prefix from the data group name. You can add debug logging to figure out why the iRule isn't working. Here's a version 10 or higher example:

when HTTP_REQUEST {
if { [class match [IP::client_addr] equals Whitelist_Sorry] } { 
log local0. "[IP::client_addr]:[TCP::client_port]: Client is in data group so do not redirect. DG: [class get Whitelist_Sorry]"
} else {
log local0. "[IP::client_addr]:[TCP::client_port]: Client is not in data group so redirect"
HTTP::redirect 
}
}

Also, [IP::client_addr] and [IP::remote_addr] will return the same value in clientside events like CLIENT_ACCEPTED and HTTP_REQUEST.

Aaron