Forum Discussion

Tyranon_113005's avatar
Tyranon_113005
Icon for Nimbostratus rankNimbostratus
Sep 11, 2018

Restrict the HTTP access by ip address in data group

I want to restrict the access to the Web server by iRule with data group. There is a data group "testclient".

 

I made irules(with some restriction) like below. When the client ipaddress in "testclient" accesses, can it access to the server in pool A?

 

when HTTP_REQUEST {

 

if { [HTTP::header exists "X-True-IP"] } { set clientip [HTTP::header "X-True-IP"] } else { set clientip [IP::client_addr] }

 

set uri [ string tolower [HTTP::uri]]

 

if {([matchclass [IP::client_addr] equals $::testclient])}{ pool A } else { pool B } }

 

2 Replies

  • what version are you working on?

     

    matchclass command is deprecated since version 10 and not working anymore in version 11.X and above.

     

  • What is the goal of x-true-ip header and uri conversion to lowercase? It is not used in your condition!

    when HTTP_REQUEST { 
        if {([class match [IP::client_addr] equals testclient])}{
     pool A
     } else { 
     pool B
        } 
     }