How to restrict a url access from a specific two ip's

Forums Technical Forums
, ,
1

Hi,

How to retsrict a url access from internet for a specific two ip’s !

whether it can be achieved via LTM policy or via irule?

logic that i have cretaed using irule given below:

when HTTP_REQUEST {

if{[HTTP::path] contains “/abc/update” and [IP::addr [IP::client_addr] equals 104.123.3.1] or [IP::addr [IP::addr [IP::client_addr] equals 117.23.2.1]}

else{

reject

}

Requesting immediate assistence

2

instead of irules scripting, you can use gui based local traffic policy.
the managebility and performance is better than irules.

https://community.f5.com/t5/technical-articles/to-irule-or-not-to-irule-introduction-to-local-traffic-policies/ta-p/279536

3

Hi,

thanks for the response

whether it is possible to share the LTM policy for the logic i have raised !

4

Hello,

I created a policy that restrict url access for the IPs listed above.

resetltp.PNG
resetltp.PNG1429×453 7.27 KB

5

If you still wanted to do this with an iRule, you could do something like this:

# Create internal data groups
tmsh create ltm data-group internal DG-IP-WHITELIST type ip records add { 104.123.3.1 117.23.2.1 }
tmsh create ltm data-group internal DG-RESTRICTED-PATHS type string records add { /abc/update } 

# iRule
when HTTP_REQUEST {
    set DEBUG 1
    set DEFAULT_POOL [LB::server pool]
    set HOST [string tolower [HTTP::host]]
    set PATH [HTTP::path]
    set CLIENT_IP [IP::client_addr]

    if { [class match -- $PATH contains DG-RESTRICTED-PATHS] } {
        if { [class match -- $CLIENT_IP equals DG-IP-WHITELIST] } {
            if { $DEBUG } { log local0. "$CLIENT_IP has been granted access to $HOST with path $PATH" }
            pool $DEFAULT_POOL
        }
        else {
            if { $DEBUG } { log local0. "$CLIENT_IP has been refused access to $HOST with path $PATH" }
            reject
        }
    }
}

6

hi,

what about below irule: whether it will meet the requirement:

when HTTP_REQUEST {

if{[HTTP::path] contains “/abc/update” and [IP::addr [IP::client_addr] equals 104.123.3.1] or [IP::addr [IP::addr [IP::client_addr] equals 117.23.2.1]}

else{

reject

}

7

Could you confirm whether source IPs 104.123.3.1 and 117.23.2.1 should be *allowed* to access path “/abc/update”. Or should they be denied?

8

only IPs 104.123.3.1 and 117.23.2.1  can acces to path “/abc/update”. remainng Ip connections from internet towards acess path “/abc/update” should be droped/blocked

9

Thanks for confirming.

I made a few minor adjustments to fix syntax issues, but this should work:

when HTTP_REQUEST {

if { [HTTP::path] contains "/abc/update" and (([IP::addr [IP::client_addr] equals 104.123.3.1]) or ([IP::addr [IP::client_addr] equals 117.23.2.1])) } {
}
else {
    reject
}
}
10

i have checked in my application. while i am calling this irule in VS the other url’s pertaining to the application also not loading in the browser

11

i have checked LTM logs also below error recieving:

tmm[9714]: 01220001:3: TCL error: /Common/UIp_TEST <HTTP_REQUEST> - invalid command name “if{/” while executing “if{[HTTP::path] contains “/uHi/upjateMobShSRrq” and (([IP::addr [IP::client_addr] equals 1XX.250.X0.X]) or ([IP::addr [IP::client_addr] equals 1XX.1XX…”

12

Try this:

when HTTP_REQUEST {

if { [HTTP::path] contains "/abc/update" and !(([IP::addr [IP::client_addr] equals 104.123.3.1]) or ([IP::addr [IP::client_addr] equals 117.23.2.1])) } {
    reject
}
}
}
13

the gui is very simple:

zamroni777_1-1704457512465.png
zamroni777_1-1704457512465.png1886×584 44.4 KB

zamroni777_2-1704457541008.png
zamroni777_2-1704457541008.png1897×515 39.7 KB

zamroni777_3-1704457572039.png
zamroni777_3-1704457572039.png1884×482 38.2 KB

14

i think the ip address inspection is better to be put in CLIENT_ACCEPTED event as it is lighter that HTTP_REQUEST event

15

Agreed.

when CLIENT_ACCEPTED {
 set CLIENT_IP [IP::client_addr]
}

when HTTP_REQUEST {

if { [HTTP::path] contains "/abc/update" and !(([IP::addr $CLIENT_IP equals 104.123.3.1]) or ([IP::addr $CLIENT_IP equals 117.23.2.1])) } {
    reject
}
}
16

is this CLIENT_IP is refered as a DataGrroup ?

17

CLIENT_IP is the variable you set in the beginning of the irule

set CLIENT_IP [IP::client_addr]

Regards

18

i have tried the irule, but too many errors coming. PFA

19

Thanks for the screenshot. Please ensure that there is a whitespace between the “CLIENT_ACCEPTED” event and the opening curly brace “{”

when CLIENT_ACCEPTED {