Forum Discussion

ian_bucknor_152's avatar
ian_bucknor_152
Icon for Nimbostratus rankNimbostratus
May 07, 2014

I need an irule for a "VIP that forwards ANY to a pool that is going to a default gateway".

I need an irule for a "VIP that forwards ANY to a pool that is going to a default gateway". The iRule will intercept traffic going to the default gateway if it matches the specified match. The example rule I came up with is below. The rule is not working because the first line is expecting the client TCP Handshake to be completed. I need a rule that would match on the first SYN sent by the client.

 

when CLIENT_ACCEPTED { log local0. "[IP::remote_addr]:[TCP::remote_port] > [IP::local_addr]:[TCP::local_port]" if { [IP::addr [IP::client_addr] equals 192.168.192.39] } { snat 192.168.186.46 log local0. "192.168.192.39 HIT, snatting to 192.168.186.46" pool gate186tunnel } if { [IP::addr [IP::client_addr] equals 192.168.192.45] } { snat 192.168.186.47 pool gate186tunnel } }

 

3 Replies

  • I don't think you need a standard VS for this. Why not just use a performance/FastL4 VS and specify the correct pool?

     

  • That is what I have configured. The Virtual Server is FastL4 and it is working for traffic that should go to the gateway configured as the Main Pool. However, for the iRule, the intent is that for traffic that matches the iRule to be sent to a different Gateway that is listed as another pool in the iRule. For normal traffic to the Virtual Server is working. For traffic that matches the iRule criteria, that tarfffic is still going to the gateway configured in the Main Pool instead of getting sent to the Pool and the different Gateway configured in the iRule.

     

  • Ah, OK. So the rule looks like this - note I've changed the second if to an elseif;

    when CLIENT_ACCEPTED {
     log local0. "[IP::remote_addr]:[TCP::remote_port] > [IP::local_addr]:[TCP::local_port]"
    
     if { [IP::addr [IP::client_addr] equals 192.168.192.39] } {
      snat 192.168.186.46
      log local0. "192.168.192.39 HIT, snatting to 192.168.186.46"
      pool gate186tunnel } 
    
     elseif { [IP::addr [IP::client_addr] equals 192.168.192.45] } { 
      snat 192.168.186.47
      pool gate186tunnel }
    }
    

    So, it looks fine to me. As it's a FastL4 virtual CLIENT_ACCEPTED should fire when the first packet arrives. Are you sure the pool has that name, in that exact case? Do you see the log messages?