Forum Discussion
Preet_pk
Cirrus
CirrusWhitelisting inboud subnet range in F5 using irule
Hi,
Is ther any option to whitelist inbound client subnet range via F5 irule for a VS.
Tried below irule , but highlighted underlined is not taking.
when HTTP_REQUEST {
if { [HTTP::host] contains "gree.lab.ae" } {
if { [IP::client_addr] equals "X.X.X.X/29"] } {
# log local0. "client with [IP::client_addr] on url [HTTP::host][HTTP::uri] Accepted"
} else {
drop
log local0. "client with [IP::client_addr] on url [HTTP::host][HTTP::uri] Denied"
}
}
}
- Nikoolayy1
MVP
You can just see the article How to match subnet of the client IP in iRule (f5.com) an better use data groups (class (f5.com)). Also better log outside of the "if else" the client IP address that the F5 device sees as if there is proxy or nat device before the F5 device it is normal that TCP ip address will not match and better try adding XFF header and matching it.
Solved: IP Filtering using Xff-clientip in iRule - DevCentral (f5.com)
