Forum Discussion

Goldz_180077's avatar
Goldz_180077
Icon for Nimbostratus rankNimbostratus
Jan 30, 2017
Solved

How to create an iRules that allowing multiple ports on a single VIP IP address

How to create an iRules that allowing multiple ports on a single VIP IP address. Example i have 1 VIP 10.10.10.10 with port range 50000-60000 for SFTP active, with pool member 20.20.20.20 port: 50000-60000.

 

Thanks! Goldz

 

  • Additionally with the same i-rule can you change your VIP to performance layer 4 instead of standard and then check do a tcpdump to see whether the VIP is doing a 3way handshake.

     

23 Replies

  • I think you can do it without i-rule as well just make the VIP and node listen on Any port.

     

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      Hi Maneesh,

      I have some few questions:

      1. Do i need to create a Standard VIP with all Ports allow then associate the iRules on it.

      2. can you check if this is correct:

      when CLIENT_ACCEPTED {

       Check if requested port is outside 50000 - 60000 
      if{not(([TCP::client_port] > 50000 and [TCP::client_port] < 60000) or [TCP::client_port] == 22) }{ 
          Drop request 
         drop 
      } 
      

      }

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      but we can access other ports. meaning the irules is not working well.

       

    • Maneesh_72711's avatar
      Maneesh_72711
      Icon for Cirrostratus rankCirrostratus

      You mean you can access the VIP on other port as well ? apart from the specified range 50000 - 60000 ?

       

      Can you paste the tcpdump output when you try connecting it from outside say TCP port 20.

       

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      i think, since we are using all ports on the VIP, that's why we can acess all ports.

       

      can you give me the tcpdump command.

       

  • On the loadbalancer CLI.

     

    tcpdump -nni 0.0 host VIP_IP and port 20

     

    Now try accessing the VIP at port 20 paste the output.

     

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      config tcpdump -nni 0.0 host 103.16.170.105 and port 20 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 17:18:16.681324 IP 49.144.189.4.34857 > 103.16.170.105.20: S 1475439677:1475439677(0) win 8192 17:18:16.681374 IP 103.16.170.105.20 > 49.144.189.4.34857: S 262887358:262887358(0) ack 1475439678 win 4380 17:18:16.790526 IP 49.144.189.4.34857 > 103.16.170.105.20: . ack 1 win 17520 17:18:21.426989 IP 49.144.189.4.34857 > 103.16.170.105.20: P 1:3(2) ack 1 win 17520 17:18:21.427026 IP 103.16.170.105.20 > 49.144.189.4.34857: R 1:1(0) ack 3 win 0

       

      config tcpdump -nni 0.0 host 103.16.170.105 and port 21 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 17:18:45.426324 IP 49.144.189.4.34867 > 103.16.170.105.21: S 774155613:774155613(0) win 8192 17:18:45.426360 IP 103.16.170.105.21 > 49.144.189.4.34867: S 2396737405:2396737405(0) ack 774155614 win 4380 17:18:45.535784 IP 49.144.189.4.34867 > 103.16.170.105.21: . ack 1 win 64240 17:18:47.654593 IP 49.144.189.4.34867 > 103.16.170.105.21: P 1:3(2) ack 1 win 64240 17:18:47.654626 IP 103.16.170.105.21 > 49.144.189.4.34867: R 1:1(0) ack 3 win 0

       

  • hmmmm thanks can you try below i-rule instead.

     

    when CLIENT_ACCEPTED {

     

    >>>>>>> Check if requested port is outside 50000 - 60000

    if{not(([TCP::local_port] > 50000 and [TCP::local_port] < 60000) or [TCP::local_port] == 22) }{

     

    Drop request

     

    drop

     

    }

     

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      Hi Maneesh,

       

      Still not working.

       

      here are the logs: config tcpdump -nni 0.0 host 103.16.170.105 and port 21 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 11:27:47.982388 IP 112.199.36.158.15008 > 103.16.170.105.21: S 1717557432:1717557432(0) win 8192 11:27:47.982451 IP 103.16.170.105.21 > 112.199.36.158.15008: S 3919905464:3919905464(0) ack 1717557433 win 4356 11:27:48.214953 IP 112.199.36.158.15008 > 103.16.170.105.21: . ack 1 win 65340 11:27:48.215095 IP 103.16.170.105.21 > 112.199.36.158.15008: R 1:1(0) ack 1 win 4356 ^C 4 packets captured 4 packets received by filter 0 packets dropped by kernel

       

      config tcpdump -nni 0.0 host 103.16.170.105 and port 3000 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 11:28:15.306792 IP 112.199.36.158.12289 > 103.16.170.105.3000: S 957326522:957326522(0) win 8192 11:28:15.306851 IP 103.16.170.105.3000 > 112.199.36.158.12289: S 3629030938:3629030938(0) ack 957326523 win 4356 11:28:15.444923 IP 112.199.36.158.12289 > 103.16.170.105.3000: . ack 1 win 65340 11:28:15.445065 IP 103.16.170.105.3000 > 112.199.36.158.12289: R 1:1(0) ack 1 win 4356 ^C 4 packets captured 4 packets received by filter 0 packets dropped by kernel

       

  • It might be worthwhile to invert your logic and drop the "not" statement, to verify everything is working, then work towards flipping it back.

    This is untested:

    if{([TCP::local_port] > 50000 and [TCP::local_port] < 60000)} {
        permit
    elseif {[TCP::local_port] == 22 }{
        permit
    } else {
         Drop request
        drop
    }
    
  • Additionally with the same i-rule can you change your VIP to performance layer 4 instead of standard and then check do a tcpdump to see whether the VIP is doing a 3way handshake.

     

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      Hi Maneesh,

       

      Pls. see below output when using a VIP Performance layer 4 associated the i Rules

       

      Accssing Port 22:

       

      Xshell:> telnet 103.16.170.105 22 Connecting to 103.16.170.105:22... Could not connect to '103.16.170.105' (port 22): Connection failed.

       

      config tcpdump -nni 0.0 host 103.16.170.105 and port 22 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 13:08:41.733700 IP 112.199.36.158.38957 > 103.16.170.105.22: S 3489628376:3489628376(0) win 8192 13:08:41.733841 IP 103.16.170.105.22 > 112.199.36.158.38957: R 0:0(0) ack 3489628377 win 0 13:08:42.286396 IP 112.199.36.158.38957 > 103.16.170.105.22: S 3489628376:3489628376(0) win 8192 13:08:42.286525 IP 103.16.170.105.22 > 112.199.36.158.38957: R 0:0(0) ack 1 win 0 13:08:42.849594 IP 112.199.36.158.38957 > 103.16.170.105.22: S 3489628376:3489628376(0) win 8192 13:08:42.849709 IP 103.16.170.105.22 > 112.199.36.158.38957: R 0:0(0) ack 1 win 0 13:08:44.263275 IP 123.183.209.136.48745 > 103.16.170.105.22: S 932940911:932940911(0) win 29200 13:08:44.263404 IP 103.16.170.105.22 > 123.183.209.136.48745: R 0:0(0) ack 932940912 win 0 ^C 8 packets captured 8 packets received by filter 0 packets dropped by kernel

       

      Accessing Port 21:

       

      Xshell:> telnet 103.16.170.105 21 Connecting to 103.16.170.105:21... Could not connect to '103.16.170.105' (port 21): Connection failed.

       

      config tcpdump -nni 0.0 host 103.16.170.105 and port 21 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 13:08:55.352515 IP 112.199.36.158.59299 > 103.16.170.105.21: S 1151819102:1151819102(0) win 8192 13:08:55.352657 IP 103.16.170.105.21 > 112.199.36.158.59299: R 0:0(0) ack 1151819103 win 0 13:08:55.905954 IP 112.199.36.158.59299 > 103.16.170.105.21: S 1151819102:1151819102(0) win 8192 13:08:55.906070 IP 103.16.170.105.21 > 112.199.36.158.59299: R 0:0(0) ack 1 win 0 13:08:56.471243 IP 112.199.36.158.59299 > 103.16.170.105.21: S 1151819102:1151819102(0) win 8192 13:08:56.471367 IP 103.16.170.105.21 > 112.199.36.158.59299: R 0:0(0) ack 1 win 0 ^X^C 6 packets captured 6 packets received by filter 0 packets dropped by kernel

       

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      Additional for Port 50000:

       

      Xshell:> telnet 103.16.170.105 50000 Connecting to 103.16.170.105:50000... Could not connect to '103.16.170.105' (port 50000): Connection failed.

       

      config tcpdump -nni 0.0 host 103.16.170.105 and port 50000 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 13:13:43.833730 IP 112.199.36.158.49801 > 103.16.170.105.50000: S 657302319:657302319(0) win 8192 13:13:43.833864 IP 103.16.170.105.50000 > 112.199.36.158.49801: R 0:0(0) ack 657302320 win 0 13:13:44.388163 IP 112.199.36.158.49801 > 103.16.170.105.50000: S 657302319:657302319(0) win 8192 13:13:44.388285 IP 103.16.170.105.50000 > 112.199.36.158.49801: R 0:0(0) ack 1 win 0 13:13:44.949583 IP 112.199.36.158.49801 > 103.16.170.105.50000: S 657302319:657302319(0) win 8192 13:13:44.949695 IP 103.16.170.105.50000 > 112.199.36.158.49801: R 0:0(0) ack 1 win 0 ^X^C 6 packets captured 6 packets received by filter 0 packets dropped by kernel

       

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      the Pool associated to VIP is configured in all protocol with port 22 monitor. since they disable the ICMP.

       

    • Goldz_180077's avatar
      Goldz_180077
      Icon for Nimbostratus rankNimbostratus

      Hi Maneesh,

       

      do we need this iRules

       

      if{([TCP::local_port] > 50000 and [TCP::local_port] < 60000)} { permit elseif {[TCP::local_port] == 22 }{ permit } else { Drop request drop }

       

      or this one

       

      when CLIENT_ACCEPTED {

       

      if{not(([TCP::local_port] > 50000 and [TCP::local_port] < 60000) or [TCP::local_port] == 22) }{

       

      drop } }