12-Jul-2022 07:28
Hi,
Is ther any option to whitelist inbound client subnet range via F5 irule for a VS.
Tried below irule , but highlighted underlined is not taking.
when HTTP_REQUEST {
if { [HTTP::host] contains "gree.lab.ae" } {
if { [IP::client_addr] equals "X.X.X.X/29"] } {
# log local0. "client with [IP::client_addr] on url [HTTP::host][HTTP::uri] Accepted"
} else {
drop
log local0. "client with [IP::client_addr] on url [HTTP::host][HTTP::uri] Denied"
}
}
}
12-Jul-2022 07:59
You can just see the article How to match subnet of the client IP in iRule (f5.com) an better use data groups (class (f5.com)). Also better log outside of the "if else" the client IP address that the F5 device sees as if there is proxy or nat device before the F5 device it is normal that TCP ip address will not match and better try adding XFF header and matching it.
Solved: IP Filtering using Xff-clientip in iRule - DevCentral (f5.com)
13-Jul-2022 03:34 - edited 13-Jul-2022 21:38