The second iRules Contest of the year wrapped up at AppWorld Berlin this week.
This contest was looking towards the future, challenging participants to write an iRule that goes beyond BIG-IP’s built-in capabilities. The theme, using WebSockets or the Message Routing Framework, inspired iRules preventing abuse and intrusion.
At the heart of it, we’ve loved the creative innovation of the iRules written for this years’ contests. The AppWorld Berlin iRules Contest submissions were inspiring. Across the board, judges’ feedback on the top contenders shared a common theme: these solutions are interesting. The winning iRules were well-documented, easy to understand, with clear potential value for production use.
Without further ado, we’re proud to announce the winners of the AppWorld Berlin iRules Contest:
Grand Prize Winner - Goerle_dev
Rule:WS-Exfil-Shield: Catching What WAFs Miss After the 101 Handshake
Summary
This iRule addresses gaps in traditional WAFs by extending session-level, behavior-based threat detection to WebSocket traffic using real-time inspection within F5 BIG-IP.
Detection operates in two stages; an initial timing-based heuristic is followed by payload validation using AI. Malicious actors are either blocked or routed to a honeypot for isolation and further observation.
This iRule closes the gap that openly documented by major WAF vendors, post-handshake Websocket blind spot, with a practical, SIEM-ready enforcement.
2nd Place - Injeyan_Kostas
Rule:WS-Shield: WebSocket Abuse Detection & Adaptive Enforcement Gateway
Summary
This iRule addresses securing WebSocket traffic by enabling real-time, behavior-based enforcement in F5 BIG-IP to proportionally mitigate abusive patterns without application changes.
It introduces a behavioral enforcement engine designed to secure WebSocket traffic with adaptive, real-time mitigation without requiring application changes.
Rather than relying on static thresholds, the system dynamically responds to behavior. Clean traffic naturally recovers, while abusive patterns escalate through enforcement tiers until they are cut off. This allows it to detect subtle, persistent attacks that traditional rate limiting often misses.
In testing, the iRule identified and disconnected a bot sending repetitive payloads every half second, without triggering a rate threshold.
The iRule adds an extensible, behavior-driven security layer that enables adaptable defenses with minimal investment, despite optional external dependencies.
3rd Place - Robb-Fr
Rule: Generic iRule Based on Datagroup Parsing
Summary
This iRule addresses the complexity of migrating large numbers of Apache virtual hosts by centralizing flexible traffic routing and redirection logic within F5 BIG-IP using simple, extensible datagroups.
It turns input into a simple form into a datagroup entry that CREATES iRULES for things like redirects, pools, error pages, rewrites, and more. This iRule is accessible to a wide range of F5 practitioners, as F5 expertise is not required. There are no direct iRule edits, and no way for them to break the device.
This iRule lowers operational friction by enabling non-NetOps teams to manage complex traffic flows, improving agility during large-scale migrations.
Category Awards
The 20 Lines or Less Award - Kai_Wilke
In honor of Colin Walker - short on lines, long on legend. The scroll bar never stood a chance.
Rule: SUPER-WEBSOCKET-HANDSHAKE-LOGGER™® (SWHL) iRule
The Layered Defense Award - ChristianEssel
For elegant use of nested virtual servers to solve problems the apps won’t.
Rule: Layered Virtual ICAP Scanning Solution
Gratitude
A big thank you to all contestants who participated in the AppWorld Berlin iRules Contest. Your creativity, innovation, and willingness to share your ideas continue to push the community forward.
Thank you to our judges:
- John_Alam
- Joel_Moses
- Moe_Jartin
- Chris_Miller
- Michael_Waechter
- dennypayne
- Kevin_Stewart
- Marcus-f5
- SimonKowallik
- Sorin_Boiangiu
- Steve Scott
Thank you to the DevCentral community. We learn together, grow together, and inspire each other every day.
What’s Next?
Innovation and Creativity have been a key part of the contest rubric. We’re leaning into it, too. As we plan more contests for the year, we’re looking beyond iRules, with potential to expand to all programmability. The future is coming for us all; let’s greet it and move forward together.
