Forum Discussion

F5_324021's avatar
F5_324021
Icon for Cirrus rankCirrus
Jul 24, 2017

Block Specific URL from Specific Region

Hello ,

 

Im trying to block HTTPS request on specific URL from specific region and source IP address.

 

Is it possible to block specific URL from a source region?

 

Example we have 3 subdomains:- a)abc.xyz.com:should blocl all source IPs from region A b)efg.xyz.com should block all source IPs from region B

 

I have tried the below irule to block a specific IP address and applied it an an HTTPS VIP unfortunately its not working:-

 

when HTTP_REQUEST { if { ([string tolower [HTTP::uri]] contains "abc") and ( [IP::addr "x.x.x.x" equals [IP::client_addr]] ) } { drop } else { return } }

 

Hope someone could help.

 

Thank you in advance.

 

iRules
LTM
security

5 Replies

Sort By
  • habib_Khan's avatar
    habib_Khan
    Icon for Nimbostratus rankNimbostratus
    Jul 24, 2017

    Hi,

     

    If your aware of what ip range or subnet you want to block you can use below irule. If geolocation wise you need to block, you need to have your LTM able to connect to Internet.

     

    when HTTP_REQUEST {

     

    if {[IP::addr [IP::client_addr] equals x.x.x.x/x]}{ drop } } If you want to drop IP and sepcific uri. You can use below irule.

     

    when HTTP_REQUEST {

     

    if {[IP::addr [IP::client_addr] equals x.x.x.x/x]}{ if {([string tolower [HTTP::uri]] contains "/xyz") || ([string tolower [HTTP::uri]] contains "/abc")|| ([string tolower [HTTP::uri]] contains "/def")}{ drop } } }

     

  • F5_324021's avatar
    F5_324021
    Icon for Cirrus rankCirrus
    Jul 24, 2017

    Hello ,

     

    I have got the below irule wokring fine, however i need to restrict based on country code or region is it possible , preferred to have country datagroup.?

     

  • F5_324021's avatar
    F5_324021
    Icon for Cirrus rankCirrus
    Jul 24, 2017

    Hello,

     

    i have used the below irule however it didnt worked:-

     

    when HTTP_REQUEST {

     

    if { ([HTTP::uri] contains "X") and ( [IP::addr "x.x.x.x" equals [IP::client_addr]] ) and ([string tolower [whereis [IP::remote_addr] country]] contains "Asia" ])} { drop } }

     

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Jul 28, 2017

    Your syntax for IP address match is wrong. It should be: 

    [IP::addr [IP::client_addr] equals x.x.x.x/x]