Forum Discussion

ant77's avatar
ant77
Icon for Cirrostratus rankCirrostratus
Apr 02, 2020

Allow access to multiple URI based on IP in data group only, while allow others full access

Can any of the irule expert please help me with creating this irule based on this condition? I think i have it, but not sure. Conditions: Create subnets data group allow users coming from these ...
application delivery
BIG-IP
iRules
Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
Apr 05, 2020
when HTTP_REQUEST {
  if { [class match [IP::client_addr] equals DG1-BLOCKED-SUBNETS]} {
    if { not ([class match [HTTP::uri] equals DG2-ALLOWED-URIs]) } {
       drop
    } 
  }
}

You were missing a [ class match

Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
Apr 07, 2020

The drop will only impact traffic from the DG1-BLOCKED-SUBNETS that does not match the DG2-ALLOWED-URIs.

 

All other traffic that is not in the DG1-BLOCKED-SUBNETS will pass for all URIs.