Forum Discussion

Angelo's avatar
Angelo
Icon for Nimbostratus rankNimbostratus
Nov 07, 2012

I-rule not working

Hi

 

 

I have a i-rule to allow multiple ports but for some reason it's not working... i can connect on any port

 

when CLIENT_ACCEPTED {

 

if { [TCP::client_port] == 8300 or [TCP::client_port] == 8301 or [TCP::client_port] == 8401 or [TCP::client_port] == 8881 or [TCP::client_port] == 8880 or [TCP::client_port] == 8731 or [TCP::client_port] == 8732 or [TCP::client_port] == 4353 or [TCP::client_port] == 8733 or [TCP::client_port] == 8525 } {

 

drop

 

}

 

}

 

application delivery
dev
devops
iRules

2 Replies

Sort By
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Nov 07, 2012

    More than two 'or' statements really isn't manageable. Can I suggest you create a Data Group of the ports you want to deny and use this;

    when CLIENT_ACCEPTED { if { [class match [string [TCP::client_port] equals denied-ports ] } { drop } }

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Nov 07, 2012
    Actually, I think it should be TCP::local_port; 

    when CLIENT_ACCEPTED {
 if { [class match [string [TCP::local_port] equals denied-ports ] } {
   drop }
}