how to limit a client IP from continuously opening connections to the server

The above iRule seems to be dealing with android(mobile client). if you know the specific client IP which is causing trouble, you might just want to block that one.

otherwise, you might want to try the irule at this link.

https://devcentral.f5.com/questions/help-need-to-create-a-irule-for-limit-client-connection (it might need to be tuned in order to match your specific requirements). This irule is more generic and filters at layer 4 (more efficient) rather than layer 7 like the one you posted.

the link:

https://devcentral.f5.com/questions/how-to-limit-a-client-ip-from-continuously-opening-connections-to-the-server

Hi Pascal, Thank you for your reply... I was reading up on the link and this is where we got our iRule from and we just tweaked it to include the Android lookup to apply the iRule only to those devices.

Actually the IP varies and is not always from the same user. But one thing in common was that the user was using an Android device when this happens.

So from what you are suggesting, it sounds like this iRule should work in our situation?

Thanks again.

Looks good to me but the rule relates to HTTP requests, not TCP connections - I assume that's OK. Also, don't forget to turn off the DEBUG when you put this into production.

Here is a better version of this irule.

when RULE_INIT {

 This is the max requests allowed during "interval" specified below.

set static::maxRate 10;

 Below is the lifetime of the subtable record in seconds. 
 This defines the interval during which requests are tallied. Example: Rate=10 and Timeout=3, allows 10 requests in 3 seconds 
 Note: do not use very high timeout because it increases memory utilization especially under high load. 
 Note: A rate of 100 in 50 seconds is the same is a rate of 20 in 1 second. But 1 second is a lot easier on memory, 
 Because the records expire more quickly and the table does become too large.
set static::timeout 3;

}

when HTTP_REQUEST {

    set getCount [table lookup -notouch -subtable requests [IP::client_addr]]
            if { $getCount equals "" } {
                log local0. "New one:  getCount=$getCount [IP::client_addr] [clock seconds]"
                table set -subtable requests [IP::client_addr] "1" $static::timeout $static::timeout
            } else {

            if { $getCount < $static::maxRate } {
                table incr -notouch -subtable requests [IP::client_addr]

            } else {
                if {$getCount == $static::maxRate } {
                    log local0. "User @ [IP::client_addr] [clock seconds] has reached $getCount in $static::timeout seconds."
                   table incr -notouch -subtable requests [IP::client_addr]
                }
                HTTP::respond 501 content "Request blocked Exceeded requests/sec limit."
                drop
                return
            }

            }

}