Forum Discussion

Willy's avatar
Willy
Icon for Nimbostratus rankNimbostratus
Dec 14, 2016

IP address filter on Virtual RDP server

I am running an LTM/ASM version 11.5.4. Recently an RDP virtual server was setup. Intention is to limit the IP addresses. Only few IP addresses are allowed access to this VS. The ASM module seems to support only policies for HTTP and HTTPS. Does someone have an alternative to building an Irule that limits the IP addresses ?

 

application delivery
ASM Advanced WAF
BIG-IP
security

3 Replies

Sort By
  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Dec 14, 2016

    Hi Willy,

    you may use one of the iRules below...

    IP::addr based iRule:

    The IP::addr based syntax is ideal, if just a few IPs or Subnets are requiring access (less than 5).

    when CLIENT_ACCEPTED {
    if { ( [IP::addr [IP::client_addr] equals "10.0.0.0/8"] )
      or ( [IP::addr [IP::client_addr] equals "172.16.0.0/12"] ) 
      or ( [IP::addr [IP::client_addr] equals "192.168.0.0/16"] ) } then {
         Allow the request
    } else {
        reject
    }
}


    [class]
    / data-group based iRule:

    The 

    [class]
    / data-group based syntax is ideal, if just if many IPs or Subnets are requiring access (more than 5)

    iRule: 

    when CLIENT_ACCEPTED {
    if { [class match [IP::client_addr] equals DG_ALLOWED_RDP_CLIENTS] } then {
         Allow the request
    } else {
        reject
    }
}

    Data-Group: 

    ltm data-group internal DG_ALLOWED_RDP_CLIENTS {
    records {
        10.0.0.0/8 {}
        172.16.0.0/12 {}
        192.168.0.0/16 {}
    }
    type ip
}

    Cheers, Kai

  • Willy's avatar
    Willy
    Icon for Nimbostratus rankNimbostratus
    Dec 14, 2016

    Hello Kai,

     

    Thank you for the quick and adequate responses. I will move on with the info received from you.

     

    Thanks, Willy