Forum Discussion

prabhat_73172's avatar
prabhat_73172
Icon for Nimbostratus rankNimbostratus
Jan 17, 2011

irule to read host from HTTP request and redirect

Hello,

 

I have BigIP LTM 10.0.1 system that sits in front of a http proxy gateway in the call path of incoming http requests in a ISP environment.

 

When customer access certain websites via proxy they experience errors. I'm trying to create an irule where it reads the host field on the http header and if it contains certain words (hotmail in this example), then it will direct the traffic via pool p1 (internet router) if not then via pool p2 (proxy gateway).

 

When I try to implement the irule I various errors. Below is the script.

 

Any assistance would be greatly appreciated.

 

 

 

when HTTP_REQUEST {

 

Specify current url

 

set host[HTTP::host]

 

 

Specify pools

 

 

set p1 "proxy_pool"

 

set p2 "internet_pool"

 

 

display current url and user agent in ltm log file

 

log "HOST = $host"

 

 

 

check if host has name that has issues going through proxy

 

switch -glob "$host" {

 

"*hotmail*" -

 

"*weather.com*" {

 

log "$host GOING TO Directly to $host -- 1.2"

 

pool $p2

 

} default {

 

log "$host GOING Through proxy-- 1.3"

 

pool $p1

 

}

 

}

 

end of switch

 

 

application delivery
dev
devops
iRules

11 Replies

Sort By
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jan 17, 2011
    You can do this without setting any variables. That'll help performance a tiny bit. 

    
when HTTP_REQUEST {
log local0. "User requested Host [HTTP::host]"
     switch -glob [string tolower [HTTP::host]] {
            "*hotmail*" -
            "*weather.com*" {
                log local0. "[HTTP::host] going directly to [HTTP::host] -- 1.2"
                pool internet_pool }
             default { 
               log local0. "[HTTP::host] going through proxy--1.3"
              pool proxy_pool }
             }
    }

    What errors were you originally seeing?
  • prabhat_73172's avatar
    prabhat_73172
    Icon for Nimbostratus rankNimbostratus
    Jan 17, 2011
    Thanks Chris for the quick response. That definitely didn't error out. We will run some tests to find if the traffic is being directed as intended.

     

    One more question. So in case if the list of sites that needs be bypassed around the proxy keeps on growing it may be easier to use a Data Group List.

     

    So if I created a Data Group List called "excluded_hosts" and tied that to this irule, how would that change the script?

     

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jan 17, 2011
    Posted By prabhat on 01/17/2011 12:38 PM

     

    Thanks Chris for the quick response. That definitely didn't error out. We will run some tests to find if the traffic is being directed as intended.

     

    One more question. So in case if the list of sites that needs be bypassed around the proxy keeps on growing it may be easier to use a Data Group List.

     

    So if I created a Data Group List called "excluded_hosts" and tied that to this irule, how would that change the script?

     

    What version of code is your LTM running? There are different options depending on version.

     

     

  • prabhat_73172's avatar
    prabhat_73172
    Icon for Nimbostratus rankNimbostratus
    Jan 17, 2011
    Its running at 10.0.1

     

     

    Also the errors I was getting earlier was "set" is out of scope....
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jan 17, 2011
    Something like this would work fine: 

    
when HTTP_REQUEST {
     log local0. "User requested Host [HTTP::host]"
       if { [class match [string tolower [HTTP::host]] contains excluded_hosts] } {
                   log local0. "[HTTP::host] going directly to [HTTP::host] -- 1.2"
                   pool internet_pool }
      else { 
                  log local0. "[HTTP::host] going through proxy--1.3"
                  pool proxy_pool }
  }
  • prabhat_73172's avatar
    prabhat_73172
    Icon for Nimbostratus rankNimbostratus
    Jan 17, 2011
    Thanks Chris. Greatly appreciate your help on this. We will give that a try and validate all works as expected.
  • prabhat_73172's avatar
    prabhat_73172
    Icon for Nimbostratus rankNimbostratus
    Jan 18, 2011
    Now the irule is working as expected but when the traffic gets routed directly to the internet_pool, it can't connect. There is only one member in that pool which is basically the firewall.

     

    When LTM sends traffic directly to the firewall, it appears the source IP is that of the device (laptops) and the firewall doesn't like it and drops packets after the initial handshake.

     

    The traffic going via proxy_pool hits the proxy and gets routed back to LTM on the way to the internet since proxy nodes don't have direct access to the internet.

     

    And in this case when LTM is passing the outgoing traffic to the firewall that it got from the proxy nodes and source IP is that of the proxy IP and the firewall allows those.

     

    So somehow we need to use SNAT that will allow the packets that are directly going to firewall from LTM to the addresses that of the proxy IP. But we're not sure the way to achieve that. We tried several ways but none work.

     

    Any help would be greatly appreciated
  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jan 18, 2011
    SNATing it to the proxy's IP will likely cause issues when the response comes back to the firewall as the firewall will already have an arp entry for the proxy.

     

     

    Does it have to be the proxy's IP or can it simply be an IP on the same subnet?

     

     

    Is this your design for outbound? Where the firewall allows the proxy's IP outbound but not the Client's?

     

     

    Client -> Proxy -> LTM -> Firewall -> Internet
  • prabhat_73172's avatar
    prabhat_73172
    Icon for Nimbostratus rankNimbostratus
    Jan 19, 2011
    Hi Chris,

     

    Here is the outbound when going through proxy

     

     

    client->LTM->proxy->LTM->firewall->internet

     

     

    Here's the outbound when the irule directs the traffic directly to the internet

     

     

    client->ltm->firewall->internet.

     

     

  • prabhat_73172's avatar
    prabhat_73172
    Icon for Nimbostratus rankNimbostratus
    Jan 19, 2011
    Nevermind Chris. So it appears that basically the LTM itself was not able to route the traffic to these hosts that were being sent directly to the internet.

     

    so we resloved those hosts to ip addresses and added the following in the bigip.conf

     

    route 201.131.100.54 {

     

    pool internet_pool

     

    }

     

    route 64.4.20.184 {

     

    pool internet_pool

     

    }

     

    route 173.203.112.165 {

     

    pool internet_pool

     

     

    and also added a snat-pool in the irule.

     

    And that worked.

     

    This not a very good work around when the traffic goes through proxy and throws a error. But this can be used to determine whether its proxy or some other element in the call path causing the error.