Forum Discussion

Alan_Millar's avatar
Alan_Millar
Icon for Nimbostratus rankNimbostratus
Jul 24, 2019
Solved

IP Filtering using Xff-clientip in iRule

We are currently using IP filtering for URIs like this:

 

  }   elseif { ([HTTP::uri] starts_with "/site") and ( [class match [IP::client_addr] equals  management_IP])} {

      use pool pSite

 

However we just started passing the traffic through a web security provider, so the source IP addresses are now the security provider IP. Is there a way we can use the X-Forwarded-For IP address in this kind of filtering?

 

 

cloud
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Jul 25, 2019

    You are right Stan! Thanks for the contribution.

     

    , here is the new code:

    when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

    KR,

    Dario.

5 Replies

Sort By
  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for MVP rankMVP
    Jul 24, 2019

    Hello Alan.

     

    Try with this code:

    when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIPList [split [HTTP::header value "X-Forwarded-For"] ","]
            set clientIP [lindex $ipList 0]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

    KR,

    Dario.

    • Stanislas_Piro2's avatar
      Stanislas_Piro2
      Icon for Cumulonimbus rankCumulonimbus
      Jul 25, 2019

       2 optimizations to your code:

       

      • use getfield command instead of split / lindex
      • use string trim command on the result to make sure there is no space before the comma
      • Dario_Garrido's avatar
        Dario_Garrido
        Icon for MVP rankMVP
        Jul 25, 2019

        You are right Stan! Thanks for the contribution.

         

        , here is the new code:

        when HTTP_REQUEST {
    if { ([HTTP::uri] starts_with "/site") } {
        if {[HTTP::header exists "X-Forwarded-For"]} {
            set clientIP [string trim [getfield [HTTP::header value "X-Forwarded-For"] "," 1] " "]
            if { ([class match $clientIP equals management_IP]) } {
                pool pSite
            }
        } else {
            pool pSite
        }
    }
}

        KR,

        Dario.