# iRule and Data group URI wildcard matching not working

**URL:** <https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765>\
**Category:** Technical Forums\
**Tags:** irules, big-ip, application-delivery\
**Created:** [April 10, 2020, 3:13pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765 "2020-04-10T15:13:17Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ant77](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@ant77](https://community.f5.com/u/ant77)\
**Post date:** [April 10, 2020, 3:13pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/1 "2020-04-10T15:13:17Z")

</div>

Hi All,

Can anyone let me know what the issue is here. I am trying to match using a wildcard or anything beyond the top level URI and it’s not working

It seems the data group string is only specific only, and anything beyond that it doesn’t work.

So what i am trying to do is look at the top level URI (/APP1), and if there is anything beyond that, allow. It should allow at the top level /APP1

and does not care any URI beyond that…

Example not working going beyond the top level URI /APP1:

[HTTPS://mysite.com/APP1/ABC/123/home.html](HTTPS://mysite.com/APP1/ABC/123/home.html)

We all know that a site does not end at just the top level /APP1/, as it can go beyond that with the other folders/URI. I just want to

match the top level, and allow anything beyond that. The irule seems to look for only /APP1/ and if you have /APP1/ABC/… it does not work.

Match or wild card in data group:

/APP1/\*

/APP2/\*

/APP3/\*

Is there a better way to do this within the irule itself for the URIs?

Thanks!

```tcl
when HTTP_REQUEST {
if [class match [IP::client_addr] equals DG1-BLOCKED-SUBNETS] {
if { not ([HTTP::uri] equals DG2-ALLOWED-URIs]) } {
reject
  }
 }
}

ltm data-group internal DG1-BLOCKED-SUBNETS {
records {
10.100.100.0/24 { }
10.200.200.0/24 { }
}
type ip
}

ltm data-group internal DG2-ALLOWED-URIs {
records {
/APP1/* { }
/APP2/*{ }
/APP3/*{ }
}
type string
}

```

---

<div class="post-metadata">

**Author:** ![ldesfosses](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@ldesfosses](https://community.f5.com/u/ldesfosses)\
**Post date:** [April 10, 2020, 3:31pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/2 "2020-04-10T15:31:49Z")

</div>

I think you want to check if you URI “start with” something, so I would use :

**starts\_with**

```tcl
if { not ([HTTP::uri] starts_with DG2-ALLOWED-URIs]) } {

```

Let me know if it’s OK for you.

---

<div class="post-metadata">

**Author:** ![ant77](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@ant77](https://community.f5.com/u/ant77)\
**Post date:** [April 10, 2020, 3:39pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/3 "2020-04-10T15:39:16Z")

</div>

Added the “starts\_with” and still same thing, no good. Is it better to call the URIs and wildcard within the irule or from a data group?

For example, i am trying to go to the URL below.

I have /APP1/\* in the data group, so the irule should allow me to come in if i match the /APP1 and anything beyond that.

[HTTPS://mysite.com/APP1/home.html](HTTPS://mysite.com/APP1/home.html)

Thanks!

---

<div class="post-metadata">

**Author:** ![ldesfosses](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@ldesfosses](https://community.f5.com/u/ldesfosses)\
**Post date:** [April 10, 2020, 4:01pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/4 "2020-04-10T16:01:15Z")

</div>

In the datagroup, you should have : /APP1/ , not /APP1/ **\***.

Regarding the if it’s better to call the URIs in the iRule or a datagroup, IMO, it depend on how many times the URIs will be added or removed and the number of entry.

For just 3 that will never change, I would do it in the iRule, because it’ll easiest for some persons to maintain. If you have a lot of URIs and it’ll change, I’ll do it in a data group, it’ll be easy to just add/remove stuff from the data group for an untrained technician.

---

<div class="post-metadata">

**Author:** ![ant77](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@ant77](https://community.f5.com/u/ant77)\
**Post date:** [April 10, 2020, 4:17pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/5 "2020-04-10T16:17:23Z")

</div>

Thanks!

Do you have an example of this irule if want to call it within the irule and not use the URI data group?

Would it look something like this?

class allowedURIs {

“/APP1/“

“/APP2/“

“/APP3/“

}

when HTTP\_REQUEST {

if [class match [IP::client\_addr] equals DG1-BLOCKED-SUBNETS] {

if { not ( [HTTP::uri] starts\_with $::allowedURIs) ] } {

reject

}

}

}

---

<div class="post-metadata">

**Author:** ![ldesfosses](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@ldesfosses](https://community.f5.com/u/ldesfosses)\
**Post date:** [April 10, 2020, 4:25pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/6 "2020-04-10T16:25:53Z")

</div>

```tcl
if { not ([HTTP::uri] starts_with "/APP1/" or "/APP2" ) } {
	#Do Something
}

```

I don’t have a BigIP right now to test, but this is how I see it.

---

<div class="post-metadata">

**Author:** ![ant77](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@ant77](https://community.f5.com/u/ant77)\
**Post date:** [April 10, 2020, 5:03pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/7 "2020-04-10T17:03:33Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![ldesfosses](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@ldesfosses](https://community.f5.com/u/ldesfosses)\
**Post date:** [April 10, 2020, 5:08pm UTC](https://community.f5.com/t/irule-and-data-group-uri-wildcard-matching-not-working/55765/8 "2020-04-10T17:08:49Z")

</div>

It’s working ?