Simple Drop rule help

Question

I have the following iRule applied to one of the Virtual servers on my F5, and what I wanted it to do was accept traffic only on the specified ports, and all other requests to drop the packets. when I run NMAP against the IP address, it shows a large amount of ports open. The Virtual server does accept all ports, but it has the iRule applied.What am I doing wrong? Thanks. &nbsp;
&nbsp;when CLIENT_ACCEPTED {
&nbsp;    if {([TCP::local_port] &gt;= 6000 ) &amp;&amp; ([TCP::local_port] &lt;= 6299) || 
&nbsp;    ([TCP::local_port] &gt;= 177 ) &amp;&amp; ([TCP::local_port] &lt;= 177) ||
&nbsp;        ([TCP::local_port] &gt;= 21 ) &amp;&amp; ([TCP::local_port] &lt;= 21) || 
&nbsp;        ([TCP::local_port] &gt;= 389 ) &amp;&amp; ([TCP::local_port] &lt;= 389) || 
&nbsp;        ([TCP::local_port] &gt;= 48140 ) &amp;&amp; ([TCP::local_port] &lt;= 48144) ||  
&nbsp;        ([TCP::local_port] &gt;= 2148 ) &amp;&amp; ([TCP::local_port] &lt;= 2148) || 
&nbsp;        ([TCP::local_port] &gt;= 13131 ) &amp;&amp; ([TCP::local_port] &lt;= 13131) || 
&nbsp;        ([TCP::local_port] &gt;= 22 ) &amp;&amp; ([TCP::local_port] &lt;= 22) } {
&nbsp;      pool SD4_Mgmnt
&nbsp;    } else drop
&nbsp;}

bl0ndie_127134 · Answer

CLIENT_ACCEPTED is fired after the 3 way handshake is completed, in another words when a connection is established.

hooleylist · Answer

I haven't tested this, but I wonder if you could use packet filters to drop the connection before the TCP handshake is complete for destination ports you don't want the VIP to answer on.&nbsp;&nbsp;Click here&nbsp;
&nbsp;Aaron

Forum Discussion

Simple Drop rule help

2 Replies

Recent Discussions

SMS server with BIGIP

F5 terminal - help to run commands - disk space full

Can iRule be used to perform exception of IPI category based on Geolocation

[ASM] - what is "Browser Challange file" ?

LDAPS and renegotiation

Related Content

Simple Sideband - iRule sideband the easy way

F5 Distributed Cloud Origin Server Subset Rules

BIG-IP Solutions: Simple URL Redirects

LTM Cipher rule

Making WAF Simple: Introducing the OWASP Compliance Dashboard