Forum Discussion

littlebunny's avatar
littlebunny
Icon for Nimbostratus rankNimbostratus
Jun 04, 2019

Only keep XFF header for specific subnet ranges

Hello

 

We have some external facing virtual servers that have requests coming in from both internal and external sources. What we'd like to do is keep XFF headers only for requests coming in from a set list of internal subnets and remove them for any requests from source IPs not defined in the list. How would we go about achieving this?

 

Thanks

AK

iRules
LTM
security

2 Replies

Sort By
  • SWJO's avatar
    SWJO
    Icon for Cirrostratus rankCirrostratus
    Jun 05, 2019

    Hi

     

    when HTTP_REQUEST {

    if { [HTTP::header exists X-Forwarded-For] } {

    if { [class match [HTTP::header X-Forwarded-For] equals my_external_ip] } {

    HTTP::header remove X-Forwarded-For

    }

    }

    else {

    return

    }

    }

     

    I didn`t test this rule. but this form would be work.

     

  • SWJO's avatar
    SWJO
    Icon for Cirrostratus rankCirrostratus
    Jun 05, 2019

    If it is easy to classify internal Ip, use this rule little switching.