For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

GTM and iRules allowing intelligent redirection for most protocols

We're all familiar with HTTP redirects. Everyone's seen one occur either via a meta refresh or at the server level. This is something that's become common place. But what about other protocols? How do I do something similar with an FTP connection, or a UDP transmission?

With iRules, it's easy.


What's more, is that you have even more granular control than just “send all requests for domain x to domain y”. That would be easy, especially at the DNS level, which is where GTM does the heavy lifting. With iRules on GTM, you can create logic such as, “When a DNS request comes in from a given range of IP addresses or subnets, if the request is for a host that is or contains one of the words/hosts in classA, dynamically determine where to send the request, based off of information in that class, and return the appropriate cname to the client”

Still with me? Good. I know it sounds complicated, but it's possible, and even relatively easy, with iRules.

Take a look:

class ip_list {
  "192.168.0.0"
  "172.27.0.0"
}

class host_list {
  "maindomain.com region1.maindomain.com"
  "someotherdomain.com specialcname.someotherdomain.com"
  “badsearchterm warning.maindomain.com”
}

rule cnameMatch {
  when DNS_REQUEST {
    set newCname [findclass [GTM::rrname] contains $::host_list " "]
    if { [string length $newCname] > 1 } {
      if{ [IP::addr [matchclass "[IP::client_addr]/24" equals $::ip_list] ] > 0 } {
        use cname $newCname
      }
    }
  }
}


And that's just one example, it just touches on the new power this gives you over your network, and more importantly, over the client experience.

With a couple of small tweaks, you could do many other interesting things with a rule like this one. Things like request prioritization, abuse protection by routing bad users/networks to certain pools, etc. are all just a couple of modifications away.

Published Feb 27, 2006
Version 1.0

4 Comments

  • Colin, what version of GTM did you test this on? I don't have irules data group functionality on 9.2.4 or 9.4.3. Thanks.
  • don't work! cant find function findclass and matchclass! my version is BIG-IP 9.3.1 Build 40.2