Forum Discussion
Hi Guys,
The "elseif" was missing a bracket. I also added the "reject" statement where if you are trying to go to the URI in the data group or URI "*/URI1/URI2/PORTAL/ADMIN" on this site, your IP must match the ones from the XFF defined in the data group. If not, it should reject. Is this correct to use the "reject" or will this deny all traffic to the site? Which is what we do not want to do. Only deny if your XFF IP does match the ones in the data group when you go the URIs on this site.
Thank you.
when HTTP_REQUEST {
if { [active_members MYPOOL-PORT-443] > 1 } {
HTTP::redirect "http://maintenance-page.company.com"
} else {
set CHECK_IP [getfield [HTTP::header values X-Forwarded-For] " " 1]
if { ([class match $CHECK_IP eq "DG-XFF-ALLOWED-IP-LIST"]) } {
if { [class match [HTTP::uri] eq "DG_RESTRICTED_URI"] } {
pool MYPOOL-PORT-443
} elseif { [class match [HTTP::uri] eq "*/URI1/URI2/PORTAL/ADMIN"] } {
HTTP::redirect "https://[HTTP::host]/SECRET/URI1/URI2/ADMIN/"
reject
}
}
}
}
hi vijay,
will the "reject" work in the code where the irule looks at the data group to match the ip obtained from the XFF header and if you go to the URI in the other data group or in the code, allow, and if your not part of the IP list, deny? otherwise allow access to the full site without restrictions? we do not want the "reject" to prevent access to the site under normal conditions if not accessing the protected URI....
thank you, tony