X-Forwarded-For Irule

when HTTP_REQUEST {
   if { not ([HTTP::header values "X-Forwarded-For"] contains "X.X.X.X" or [HTTP::header values "X-Forwarded-For"] contains "X.X.X.X")}{
      HTTP::respond 200 content "Apology Page - External BlockedWe are sorry, but the site you are looking for is temporarily out of service Please try again later ." 
   }
}

when HTTP_REQUEST {

   switch -glob [HTTP::header values "X-Forwarded-For"] {
      "*1.1.1.1*" -
      "*2.2.2.2*" {
          Do nothing
      }
      default {
          Send the block page content
         HTTP::respond 200 content "Apology Page - External BlockedWe are sorry, but the site you are looking for is temporarily out of service Please try again later ." 
      }
   }
}

"

when HTTP_REQUEST {

    Track whether we've found a match yet
   set match 0

    Check if there is at least one XFF header with a value
   if {[HTTP::header values "X-Forwarded-For"] ne ""}{

      log local0. "XFF: [HTTP::header values "X-Forwarded-For"]"

       Remove spaces from the XFF header values and then split them into a list on commas
       Loop through each list item (an IP)
      foreach xff [split [string map [list " " ""] [HTTP::header "X-Forwarded-For"]] ","] {

         log local0. "Current XFF element: $xff"

          Check if the current XFF IP is in the subnet we want to check
         if {[IP::addr $xff equals 10.0.0.0/8]}{

             Track that we've found a match and exit the loop
            log local0. "Matched IP::addr check"
            set match 1
            break
         }
      }
   }
    Block the request if there wasn't a 10.0.0.0/8 XFF IP in the list
   if {$match == 0}{
      HTTP::respond 200 content {Blocked!}
   }
}