Forum Discussion
awan_m
Cirrus
thanks for the reply - its a specific domain IPs to be able to connect to a VIP that presents an API . the problem with an ip address list is that i will change all the time . i need to resolve the requestors IP to a domain and if its *.XYZ.com the allow it to connect .
Michael__
May 19, 2023Nimbostratus
Hi,
you could try that with an irule, something that way:
when CLIENT_ACCEPTED {
set CLIENTIP [IP::client_addr]
set PTR "[lindex [RESOLV::lookup @1.1.1.1 -ptr $CLIENTIP] 0]"
set PTRreverse "[lindex [RESOLV::lookup @1.1.1.1 -a $PTR] 0]"
if {($CLIENTIP eq $PTRreverse) && ($PTR ends_with ".microsoft.com")}{
log local0. "OK - $CLIENTIP - $PTR - $PTRreverse -"
} else {
log local0. "FAIL - $CLIENTIP - $PTR - $PTRreverse -"
reject
}
}