Forum Discussion

Geethanjali_321's avatar
Geethanjali_321
Icon for Nimbostratus rankNimbostratus
Oct 23, 2012

Access restriction to a single virtual server for a specific IP address

Hi,

 

 

We have many virtual servers running behind our load balancer. I want to block a specific user (eg: 10.10.10.1) from accessing one virtual server alone. I find a lot of forums which explains how to reject a specific IP address. But that applies for all the virtual servers. I want that source IP to have access to all the other virtual servers behind the load balancer, excpet this one. Also, I want this virtual server to allow all other users except this one. Can anyone help me create an irule for this?

 

 

Thanks and Regards,

 

Geethanjali

 

5 Replies

  • We have many virtual servers running behind our load balancer

     

     

    You mean :

     

    We have many virtual servers running on our load balancer

     

     

    If so then:

     

     

    an iRule is applied to a virtual server has no effect on other virtual servers.
  • You could either use a packet filter specifying the one source IP and VS destination or an iRule such as this, which you would apply only to the VS in question;

    
    when CLIENT_ACCEPTED {
     if { [IP::addr [IP::client_addr] equals x.x.x.x] } {
     drop
     return
    }
    }
    
  • Thank you so much Lies Beneath and Mohamed. My question is how to apply it to just one VS? in the configuration utility, Main< Local Traffic< Virtual Servers. Click on the Virtual server, under the resources tab, we find iRules and should I go through the manage option? Or, Main< Local Traffic

     

     

    Geethanjali

     

  • It's not clear what exactly is confusing you here.

     

     

    You can only apply an irule to one virtual server at a time. You cannot apply an iRule to many or to all, virtual servers at once.

     

     

  • Yes, My question is how to add it to one Virtual server. Because I just created the rule, by Main< Local Traffic< iRule and create option. I gave the name for the rule and the decription as

    when CLIENT_ACCEPTED {
     if { [IP::addr [IP::client_addr] equals x.x.x.x] } {
     drop
     return
    }
    }

    and It does not apply to the "xyz" Virtual server I want to apply it to. The iRule remains for the whole system.