Forum Discussion

venom43212_9610's avatar
venom43212_9610
Icon for Nimbostratus rankNimbostratus
Aug 04, 2011

iRule to Filter on X-Netli-Forward-For value

I am trying to create an iRule that will look at the X-Netli-Forward-For value, and if it matches an IP address, it is forwarded on, if it does not, it is dropped. Basically, I only want to allow a global PAT to to be forwarded on from the VIP, and everything else to drop. Any help would be appreciated. Thanks.
application delivery
dev
devops
iRules

3 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Aug 04, 2011
    If you create an address type datagroup you can use an iRule like this. Keep in mind that users can insert any arbitrary header. So if someone knew you were using this kind of logic they could bypass it. 

    
when HTTP_REQUEST {

    Check if the XFF header is set and not null
   if {[HTTP::header X-Netli-Forward-For] ne ""}{

       Look up the value in the allowed_ips_class datagroup
      if {not [class match [IP::client_addr] equals allowed_ips_class]}{

  Reset the connection
 reject
      }
   }
}

    Aaron
  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Icon for Nacreous rankNacreous
    Aug 05, 2011

    This post was intentionally left blank as formatting is impossible. What are you guys using to put HTML tags in an iRule , think HTTP::respond, in a post on these forums?

     

  • venom43212_9610's avatar
    venom43212_9610
    Icon for Nimbostratus rankNimbostratus
    Aug 05, 2011
    Thanks for the replies. There are actually two globals, so the data group suggestion by Aaron worked out great. Also, good call out on the header insertion. Thanks again.