Restricting Access to Virtual from client IP address in X-Forwarder-For HTTP header
Description
If you have a Proxy in front of the BIG-IP and all the client IP are source Natted, You can still restrict access to the Virtual if the client IP address is inserted by the proxy as HTTP Header X-Forwarder-For
Environment
- iRule
- LTM
Cause
This is a example iRule with datagroup to restrict access to a Virtual when the client IP address is inserted on the HTTP Header "X-Forwarder-For"
Recommended Actions
when HTTP_REQUEST {
if { [matchclass [HTTP::header "X-Forwarded-For"] equals clients_dg] } {
set xffHeader "[HTTP::header X-Forwarded-For]"
log local0. "X-Forwarded-For IP dropped $xffHeader"
drop
}
}
ltm data-group internal clients_dg {
records {
10.1.1.51/32 { }
10.1.1.79/32 { }
52.100.100.100/32 { } <--------!!!
}
type ip
}In the above example Client coming from a public IP [52.100.100.100] address is source natted by the proxy in front of the BIG-IP. The proxy inserts a HTTP header "X-Forwarded-For".
The above example iRule uses data-group to parse the list of blocked IP addresses.
The BIG-IP will log a message on the /var/log/ltm file as below:
Mar 8 10:48:04 BigIP-UnitE-TMOS-15.test.local info tmm3[12003]: Rule /Common/xff-drop <HTTP_REQUEST>: X-Forwarded-For IP dropped 52.100.100.100
