Forum Discussion

Anthony_7417's avatar
Anthony_7417
Historic F5 Account
Jan 30, 2009

GTM iRule to allow Wideip requests from specific addresses only - like BIND's "allow-query"

 

While BIND has mechanisms like the "allow-query" statement in order to limit IPs that can query for zone data, I couldn't find a clean way to mimic this behavior for GTM wideips. There doesn't seem to be a great way to make sure a wideip will only answer for clients on internal networks, and drop requests from the outside.

 

 

While it could be done using topology records, topology doesn't seem to be the right tool for the job.

 

 

I came up with this quick and simple iRule that seems to do the job. Note that matchclass doesn't work for GTM iRules yet, so this rule could get ugly if you had a long list IP networks to allow.

 

 

This iRule allows DNS queries to be processed if they are from a non-routable RFC1918 address. Requests from other addresses are simply dropped.

 

 

 

when DNS_REQUEST {

 

if { [IP::addr [IP::client_addr]/8 equals 10.0.0.0] \

 

or [IP::addr [IP::client_addr]/12 equals 172.16.0.0] \

 

or [IP::addr [IP::client_addr]/16 equals 192.168.0.0] } {

 

log local2. "[IP::client_addr] is an internal address. GTM will answer."

 

return

 

} else {

 

log local2. "[IP::client_addr] is NOT an internal address. GTM will NOT answer."

 

drop

 

}

 

}

 

 

 

You can simply add the iRule to any wideip you want to keep as an internal-only wideip. (Remove the logging lines after you are done testing).

 

 

I wanted to post this up here in case anyone else was interested. If anyone has any suggestions, I'd love to hear them.

 

application delivery
dev
devops
iRules

3 Replies

Sort By
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Feb 16, 2009
    Actually topology records would be the right place. Basically you can configure it so that it will allow internal address to match and then everything ELSE it will simply provide a non routable address. Much easier in my mind in a gui then writing it up in a script.

     

     

    CB

     

  • Anthony_7417's avatar
    Anthony_7417
    Historic F5 Account
    Feb 16, 2009

     

    Yeah, you could do that, and that'd work. You could also make the destination of the topology records a pool which is set to 'drop packet' or 'return to DNS'. But since topology records are shared, if you already have a complex set of topology records configured for other wideips, it might take a lot of thought + planning to re-work the toplogy rules to include access control. And returning non-routable addresses just doesn't seem clean to me.

     

     

    With the iRule, you write it once, than apply it to whatever wideip you desire. The iRule also makes it very clear what's going on, where as someone looking at a set of topology records might not understand the intent.

     

     

    The iRule might be a little difficult to maintain since GTM doesn't have matchclass, which is a bit of a shame. When GTM gets matchclass, an iRule like this should be much more maintainable.
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Feb 16, 2009
    I guess it all depends on how you built your topology.

     

     

    Click here if you want to post it in the samples section of devcentral.

     

     

    CB