# iRule command to allow IP range to access specific URL

**URL:** <https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188>\
**Category:** Technical Forums\
**Tags:** irules, url, application-delivery\
**Created:** [September 25, 2024, 10:28am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188 "2024-09-25T10:28:49Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![jayson27](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jayson27](https://community.f5.com/u/jayson27)\
**Post date:** [September 25, 2024, 10:28am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/1 "2024-09-25T10:28:49Z")

</div>

Hi,

We are having a project that require us to allow only set of IP ranges to access specific URL. May I know if this is possible via iRule?

---

<div class="post-metadata">

**Author:** ![Ozzy](https://avatars.discourse-cdn.com/v4/letter/o/b5e925/32.png) [@Ozzy](https://community.f5.com/u/Ozzy)\
**Post date:** [September 26, 2024, 2:58pm UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/2 "2024-09-26T14:58:01Z")

</div>

hello ,

yes it is possible.. here is the example..

when HTTP\_REQUEST {  
&nbsp; &nbsp; set srcip [IP::client\_addr]  
&nbsp; &nbsp; if { [HTTP::header exists “X-Forwarded-For”] } {  
&nbsp; &nbsp; &nbsp; &nbsp; set srcip [HTTP::header “X-Forwarded-For”]  
&nbsp; &nbsp; &nbsp; &nbsp; #log local0. “USER-SOURCE $srcip”  
&nbsp; &nbsp; }  
&nbsp;  
&nbsp; &nbsp; if &nbsp;{ [HTTP::path] starts\_with “/xzy” } {  
&nbsp; &nbsp; &nbsp; &nbsp; switch $srcip {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “13.174.130.182” -  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “31.121.101.157” -  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “35.77.107.183” {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ACCESS::disable  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }  
&nbsp; &nbsp; &nbsp; &nbsp; }  
&nbsp; &nbsp; }  
}

---

<div class="post-metadata">

**Author:** ![Aswin\_mk](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/aswin_mk/32/5701_2.png) [@Aswin\_mk](https://community.f5.com/u/Aswin_mk)\
**Post date:** [September 26, 2024, 3:52pm UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/3 "2024-09-26T15:52:34Z")

</div>

you can use this if you want to block any specific ip to a vip - [Restricting access to a virtual server by IP subnet (f5.com)](https://my.f5.com/manage/s/article/K42075438)

or please let me know if its only specific to urls?

---

<div class="post-metadata">

**Author:** ![jayson27](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jayson27](https://community.f5.com/u/jayson27)\
**Post date:** [September 27, 2024, 1:43am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/4 "2024-09-27T01:43:11Z")

</div>

Hi Aswin,

Yes we will allow only specific IPs to access specific URL

---

<div class="post-metadata">

**Author:** ![jayson27](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jayson27](https://community.f5.com/u/jayson27)\
**Post date:** [September 27, 2024, 1:46am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/5 "2024-09-27T01:46:44Z")

</div>

Hi,

Can you tell me if below is correct?

if &nbsp;{ [HTTP::path] starts\_with “/xzy” } {&nbsp; &nbsp; &nbsp; &nbsp; \<\<\<\<\<\<\<\<\< URL  
&nbsp; &nbsp; &nbsp; &nbsp; switch $srcip {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “13.174.130.182” -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\< IPs Allowed?  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “31.121.101.157” -  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “35.77.107.183” {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ACCESS::disable&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\< Action?

---

<div class="post-metadata">

**Author:** ![Ozzy](https://avatars.discourse-cdn.com/v4/letter/o/b5e925/32.png) [@Ozzy](https://community.f5.com/u/Ozzy)\
**Post date:** [September 27, 2024, 6:05am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/6 "2024-09-27T06:05:29Z")

</div>

hello Jayson27,

it is just an example …

instead of ACCESS::disable .. you can user “reject” or

HTTP::respond 403 content {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<html\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<head\>\<title\>403 Forbidden\</title\>\</head\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<body\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<h1\>403 Forbidden\</h1\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<p\>Access denied: Your IP address does not have permission to access this resource.\</p\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \</body\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \</html\>  
&nbsp; &nbsp; &nbsp; &nbsp; } Content-Type “text/html”  
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;  
&nbsp; &nbsp; &nbsp; &nbsp; # ends the connection  
&nbsp; &nbsp; &nbsp; &nbsp; reject  
&nbsp; &nbsp; }

---

<div class="post-metadata">

**Author:** ![jayson27](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jayson27](https://community.f5.com/u/jayson27)\
**Post date:** [September 27, 2024, 6:14am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/7 "2024-09-27T06:14:48Z")

</div>

Hi,

the iRule config will be like this? Where can i include the allowed IP?

when HTTP\_REQUEST {  
&nbsp; &nbsp; set srcip [IP::client\_addr]  
&nbsp; &nbsp; if { [HTTP::header exists “X-Forwarded-For”] } {  
&nbsp; &nbsp; &nbsp; &nbsp; set srcip [HTTP::header “X-Forwarded-For”]  
&nbsp; &nbsp; &nbsp; &nbsp; #log local0. “USER-SOURCE $srcip”  
&nbsp; &nbsp; }  
&nbsp;  
&nbsp; &nbsp; if &nbsp;{ [HTTP::path] starts\_with “/bo/login/” } {  
&nbsp; &nbsp; &nbsp; &nbsp; switch $srcip {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “13.174.130.182”  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “31.121.101.157”  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; “35.77.107.183”

{ HTTP::respond 403 content {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<html\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<head\>\<title\>403 Forbidden\</title\>\</head\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<body\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<h1\>403 Forbidden\</h1\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<p\>Access denied: Your IP address does not have permission to access this resource.\</p\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \</body\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \</html\>  
&nbsp; &nbsp; &nbsp; &nbsp; } Content-Type “text/html”  
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;  
&nbsp; &nbsp; &nbsp; &nbsp; # ends the connection  
&nbsp; &nbsp; &nbsp; &nbsp; reject  
&nbsp; &nbsp; }  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }  
&nbsp; &nbsp; &nbsp; &nbsp; }  
&nbsp; &nbsp; }  
}

---

<div class="post-metadata">

**Author:** ![Ozzy](https://avatars.discourse-cdn.com/v4/letter/o/b5e925/32.png) [@Ozzy](https://community.f5.com/u/Ozzy)\
**Post date:** [September 27, 2024, 6:44am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/8 "2024-09-27T06:44:58Z")

</div>

I don’t understand exactly what you want, but I think it would be easier to allow only certain IPs and block the rest… you can update it this way.. &nbsp;I am giving very general examples here, which you can modify and apply as you wish.

when CLIENT\_ACCEPTED {  
&nbsp; &nbsp; # allowed IPS  
&nbsp; &nbsp; set allowed\_ips {192.168.1.100 10.0.0.50 172.16.0.20}

#client IP  
&nbsp; &nbsp; set client\_ip [IP::client\_addr]

# check the client IP is in the allowed-IPs  
&nbsp; &nbsp; if { [lsearch -exact $allowed\_ips $client\_ip] \< 0 } {  
&nbsp; &nbsp; &nbsp; &nbsp; # if not , logged, blocked and message&nbsp;  
&nbsp; &nbsp; &nbsp; &nbsp; log local0. “Blocked IP: $client\_ip tried to access without permission.”

HTTP::respond 403 content {  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<html\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<head\>\<title\>403 Forbidden\</title\>\</head\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<body\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<h1\>403 Forbidden\</h1\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \<p\>Access denied: Your IP address does not have permission to access this resource.\</p\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \</body\>  
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \</html\>  
&nbsp; &nbsp; &nbsp; &nbsp; } Content-Type “text/html”

reject  
&nbsp; &nbsp; }  
&nbsp; &nbsp; # If the client IP is among the allowed ones, continue as normal workflow  
}

---

<div class="post-metadata">

**Author:** ![jayson27](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jayson27](https://community.f5.com/u/jayson27)\
**Post date:** [September 27, 2024, 6:54am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/9 "2024-09-27T06:54:28Z")

</div>

I am now getting the iRule but can I add also the URI to filter.

What we are trying to achieve is when client with IP 10.1.1.1 (sample only) access the http uri path “/example/login” it will be allowed then others will be deny.

---

<div class="post-metadata">

**Author:** ![Injeyan\_Kostas](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/injeyan_kostas/32/263_2.png) [@Injeyan\_Kostas](https://community.f5.com/u/Injeyan_Kostas)\
**Post date:** [September 28, 2024, 8:25pm UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/10 "2024-09-28T20:25:04Z")

</div>

In the long run it would be easier to use irule data groups so you can adding urls and IPs without touching the irule

---

<div class="post-metadata">

**Author:** ![Aswin\_mk](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/aswin_mk/32/5701_2.png) [@Aswin\_mk](https://community.f5.com/u/Aswin_mk)\
**Post date:** [September 29, 2024, 7:45pm UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/11 "2024-09-29T19:45:17Z")

</div>

Hi @jayson27

Did you get expected answer. ? I can see so many irule attached in this conversation now

---

<div class="post-metadata">

**Author:** ![jayson27](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jayson27](https://community.f5.com/u/jayson27)\
**Post date:** [October 11, 2024, 9:21am UTC](https://community.f5.com/t/irule-command-to-allow-ip-range-to-access-specific-url/75188/12 "2024-10-11T09:21:28Z")

</div>

I resolved the issue by using the LTM Policy instead of the iRule.