Can I route only users coming from the internal network (specific IPs) to a test server?

Short answer

Yes. In the Source IP condition, Source IP Type = Manual is selected and the internal network addresses or CIDR blocks are written, and the condition is bound to a Conditional Backend Services (Content Switching) block that targets the test server; the other users continue to go to Default Backend Services. To separate only a specific path or domain name, the Source IP condition is combined with a Path or HTTP Header condition with and in the same group. If there is a proxy in front of TR7, a Trusted Proxy profile is assigned to the HTTP vService; otherwise the condition sees the address of the proxy.

Problem: The Test Server Must Be Open Only to Internal Users

Before a new version is put into production, there may be a need to try it only with users coming from inside the company. Among the requests that come to the same address, those coming from internal network addresses must go to the test server and the others to the existing servers. No change is required on the Backend Service side; the separation is done in TR7.

Solution: Three Methods

Your situation	Suitable method
The client's address is to be compared with a few addresses or network blocks	Method 1: Source IP → Manual
The address is to be read from a Smart Variable other than the client address, or the list is to be kept separately	Method 2: Dynamic list (IP/cidr match)
A Smart Variable is to be compared with a single network block	Method 3: Dynamic condition (IP/cidr match)

Method 1: Source IP → Manual Recommended

• How it works The IP address of the client is compared with the written address and CIDR list; matching requests go to the Backend Services of the block.
• Where it is openedLoad Balancer → Conditions → Source IP → Manual · vService → + Conditional backend services
• Requirement HTTP or L7 TCP vService; if TR7 is behind a proxy, a Trusted proxy profile on the HTTP vService
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Assign the Trusted proxy profile if behind a proxy (if needed)

If there is a proxy, a CDN or an address-translating device in front of TR7, the condition sees the address of that device, not of the client. For the HTTP vService, with Load Balancer → Profiles → Trusted Proxies → Add, Real IP from and the Trusted Networks addresses of the proxy are entered under Sources and saved with Add (profile add form); in the Details panel of the vService form, Trusted Proxy is checked and the profile is selected (how to add it to a vService). There is no Trusted proxy profile on the L7 TCP vService. If there is no proxy, this step is skipped.

2

Adım 2 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

3

Adım 3 Write the addresses

The Condition Name is entered, and Criteria = Source IP and Source IP Type = Manual are selected. In the Source IP field, IPv4 or IPv6 addresses and CIDR blocks are written separated by spaces or one per line (e.g. 198.51.100.0/24). Lines starting with # are considered comments; comments are not written inside a line.

4

Adım 4 Save the condition

The condition is saved with Add.

5

Adım 5 Define the test server (if needed)

If the test server is not yet defined in TR7 as a Backend Service, the Backend Service Name, Address (e.g. 192.0.2.31:8080) and Health Check are entered with Load Balancer → Backend Services → Add and saved with Add; if no Health check is selected (default No check), it is not detected that the server is unreachable. Details: How is a Backend Service added; which information is required?

6

Adım 6 Add the block

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked; + Conditional backend services above the Default Backend Services table is clicked. In the Select Conditions field of the block, the condition is selected, and in the Backend Services table, the test server is selected.

7

Adım 7 Limit by path or domain name (optional)

If routing is wanted only on a specific path or domain name, first a Criteria = Path condition (e.g. Start /test/) or an HTTP Header condition with Host as the Header Name (Exact Match) is created (How do I route to different servers based on the URL path (e.g. /api → API servers)?; Can I route based on the Host Header?). This condition is added to the same group in the block, and the switch of the group is left in the and position (multiple condition logic). Path and HTTP header conditions can be selected only on the HTTP vService.

8

Adım 8 Save the vService

The vService is saved with Save. In a cluster setup, the change is transferred to the peer device automatically while Manual Sync Mode is off (default).

Verification

1Request from the internal networkTR7 side

A request is sent from a client in the internal network; in the Left Monitor Panel, the vService is opened and the Backend Service column is checked on the HTTP Logs screen in the Logs & Tracking tab (a Logs profile must have been assigned to the vService). On the L7 TCP vService, the Backend Service that the connection went to is seen on the vService Sessions screen in the same tab.

ExpectedRequest from the internal network → test server

2External userClient side

A request is sent from an address outside the internal network, and the Backend Service that the request went to is checked on the HTTP Logs screen.

ExpectedDefault backend services

Method 2: Dynamic List (IP/cidr match)

• How it works The value of the Smart Variable in the Key to Search field (by default the client IP address) is searched in a multi-line IP/CIDR list.
• Where it is openedLoad Balancer → Conditions → Dynamic List
• Requirement HTTP or L7 TCP vService
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

2

Adım 2 Define the list

The Condition Name is entered and Criteria = Dynamic List is selected. Key to Search is the client IP address by default; if another Smart Variable is needed, it is selected with fx. Search Method = IP/cidr match is selected and one address or block per line is written in the List field. The search method comes as Exact match in the form; since this method does not match IP blocks (such as /24), IP/cidr match must be selected in an IP list.

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Define the test server (if needed)

If the test server is not yet a Backend Service in TR7, it is defined with Load Balancer → Backend Services → Add (How is a Backend Service added; which information is required?).

5

Adım 5 Add the block

The vService is opened with Edit; a block is added with + Conditional backend services, and the condition is selected in the Select Conditions field and the test server in the Backend Services table.

6

Adım 6 Save the vService

The vService is saved with Save.

Verification

1RoutingTR7 side

Requests are sent from one address in the list and one address outside the list; the Backend Service that the requests went to is checked on the HTTP Logs screen.

ExpectedAddress in the list → test server · others → Default backend services

Method 3: Dynamic Condition (IP/cidr match)

• How it works The value of the Smart Variable in the Query Key field (e.g. the client IP address) is compared with a single IP/CIDR block.
• Where it is openedLoad Balancer → Conditions → Dynamic Condition
• Requirement HTTP or L7 TCP vService
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

2

Adım 2 Define the comparison

The Condition Name is entered and Criteria = Dynamic Condition is selected. In the Query Key field, the client IP address variable is selected with fx; Operator = IP/cidr match is selected and the network address and CIDR (e.g. 198.51.100.0 / 24) are entered in the IP/cidr to compare field.

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Define the test server (if needed)

If the test server is not yet a Backend Service in TR7, it is defined with Load Balancer → Backend Services → Add (How is a Backend Service added; which information is required?).

5

Adım 5 Add the block

The vService is opened with Edit; a block is added with + Conditional backend services, and the condition is selected in the Select Conditions field and the test server in the Backend Services table.

6

Adım 6 Save the vService

The vService is saved with Save.

Verification

1RoutingTR7 side

Requests are sent from one address inside the block and one address outside it; the Backend Service that the requests went to is checked on the HTTP Logs screen.

ExpectedAddress in the block → test server · others → Default backend services

Common Mistakes

• Not assigning a Trusted proxy profile while TR7 is behind a proxy or an address-translating device. In this case, the condition sees the address of that device, and all requests are evaluated as if they came from the same address. On the HTTP vService, a Trusted proxy profile is assigned; on the L7 TCP vService, this profile does not exist.
• Writing inline comments. # is considered a comment only at the start of a line; a comment written next to an address is evaluated as an invalid address.
• Saving the addresses without checking them. In the Source IP field, the address format is not validated on save; if all the lines are comments, the condition matches no request.
• Defining the opposite separately. If "not the internal network" is needed, the negated form of the condition that comes ready in the list is selected (Can I use a condition in negated form ("if not")?).

How it is done in the documentation

• Source IP · Manual
• HTTP (L7) vService · Multiple conditions: AND / OR logic
• Dynamic List · Search Method
• Trusted Proxies · The Components That Use the Resolved Address

Related questions

• How do I do a canary or blue-green deployment?
• Can I route clients to a different backend based on their country / city?
• Can I use a condition in negated form ("if not")?
• Can I apply different rules per destination IP on a vService published on multiple IP addresses (Destination IP)?