Can I apply different rules per destination IP on a vService published on multiple IP addresses (Destination IP)?

Short answer

Yes, on HTTP and L7 TCP vServices. The Destination IP condition compares the vService address the client connects to exactly with a single IPv4 or IPv6 address written in the condition; it does not accept CIDR, so a separate condition is defined for each address. If the condition is bound to a Conditional Backend Services block, the traffic coming to that address goes to different Backend Services; if it is bound to the Conditions field of an action (e.g. Block, Add HTTP Header), it is applied only to the traffic coming to that address. If the address is to be compared with a block, the Destination IP address variable is used with IP/cidr match in a Dynamic Condition. This condition is not used on the Network vService.

Problem: The Same vService Is Published from Addresses with Different Purposes

There can be more than one IP address in the Frontend list of a vService: for example, 203.0.113.10 open to the internet and 192.0.2.10 for the internal network. Even if the two addresses publish the same application, different behavior is usually wanted: requests coming to the internal address must go to separate servers, and stricter rules must be applied to requests coming to the external address. Without opening a separate vService, this separation is done with a condition that looks at which address the request came to.

Solution: Three Methods

Method 1 and Method 2 use the same Destination IP condition in different places and can also be applied together; Method 3 takes the place of the condition when an address block is needed instead of a single address.

Your situation	Suitable method
The traffic coming to each address must go to different Backend Services	Method 1: Conditional Backend Services
The Backend Service must stay the same; a different operation, such as blocking or adding a header, must be applied according to the address	Method 2: The Conditions field of the action
The destination address must be compared not with a single IP but with a network block	Method 3: Dynamic Condition (IP/cidr match)

Method 1: Conditional Backend Services Recommended

• How it works The Destination IP condition is bound to a Conditional Backend Services (Content Switching) block; requests coming to that address go to the Backend Services of the block, and the others go to the Default Backend Services.
• Where it is openedLoad Balancer → Conditions → Destination IP · vService form → + Conditional backend services
• Requirement The addresses must be defined in the Frontend list of the vService; the target servers must be defined as Backend Services
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Add the addresses to the vService (if needed)

There must be a row for each address in the Frontend list of the vService. If one is missing, the vService is opened with Edit, a row is added with the (+) icon, the Frontend IP and Port are selected, and the form is saved. If the address is not in the Frontend IP list, it is first added to an interface (Add IP Address; in a cluster setup, VIP).

2

Adım 2 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

3

Adım 3 Define the destination address

The Condition Name is entered (e.g. vip-ic-ag), Criteria = Destination IP is selected, and a single address is written in the Destination IP field (e.g. 192.0.2.10). The field takes an IPv4 or IPv6 address and does not accept CIDR.

4

Adım 4 Save the condition

The Add button is clicked. If a condition is also needed for another address, the second condition is defined with Add & Repeat without leaving the window.

5

Adım 5 Open the vService edit form

The Load Balancer → Load Balancer vService List steps are followed and the vService is opened with Edit.

6

Adım 6 Add a conditional block

The + Conditional backend services button in the Default Backend Services table is clicked.

7

Adım 7 Select the condition and the target

In the Select Conditions field of the block, the condition from step 3 is selected, and in the Backend Service selector, the Backend Services that the traffic coming to this address will go to are selected. No separate block is needed for the traffic coming to the other address; that traffic goes to the Default Backend Services.

8

Adım 8 Save

The Save button is clicked.

Verification

1Connection chainTR7 side

On an HTTP vService, a record is clicked on the Logs & Tracking → HTTP Logs screen of the vService; the Connection Info line in the Summary tab of the preview shows the client, the vService address the request came to and the Backend Service that responded. For the record to be created, the LOG field must be on in the vService.

ExpectedRequest coming to 192.0.2.10 → Backend Service of the block · Request coming to 203.0.113.10 → Default Backend Services

On the L7 TCP vService, the open connections and the Backend Service they went to are seen in the vService Sessions source.

2Request testClient side

The same request is sent to the two addresses separately.

Commandcurl -s http://192.0.2.10/ ; curl -s http://203.0.113.10/

ExpectedThe two responses come from different Backend Services

Method 2: The Conditions Field of the Action

• How it works The Destination IP condition is selected in the Conditions field of an action; the action runs only on the traffic coming to that address. The condition is listed in both On Request and On Response actions.
• Where it is openedLoad Balancer → Actions · vService form → Details → Actions
• Requirement The Destination IP condition created in steps 2–4 of Method 1
• vService type HTTP · L7 TCP (in the vService types that the action type supports)

Step-by-Step Configuration

1

Adım 1 Open the action form

The Load Balancer → Actions → Add steps are followed.

2

Adım 2 Define the action

The Action Name is entered and the Action Type is selected; for example, Block to block the /admin requests coming to the external address, or Add HTTP Header to add a header to the requests coming to the internal address. In the Conditions field, the Destination IP condition is selected; multiple conditions are combined with and / or (e.g. Destination IP and Path).

3

Adım 3 Save the action

The Add button is clicked.

4

Adım 4 Open the Details panel of the vService

The Load Balancer → Load Balancer vService List steps are followed, the vService is opened and the Details button at the top of the form is clicked.

5

Adım 5 Add the action to the vService

The created action is selected in the Actions field.

6

Adım 6 Save

The Save button is clicked.

Verification

1Behavior per addressClient side

In the Block action example, the same path is requested from the two addresses.

Commandcurl -sI http://203.0.113.10/admin ; curl -sI http://192.0.2.10/admin

ExpectedExternal address: the blocking response selected in the action · internal address: the response of the Backend Service

In countable action types (e.g. Block, Add HTTP Header), how many times the action ran is also monitored by turning on Hit Counter.

Method 3: Dynamic Condition (IP/cidr match)

• How it works The Destination IP address variable in the Query Key field, that is, the vService address the request came to, is compared with an IP/CIDR block. In this way, a single condition covers all the addresses in the block.
• Where it is openedLoad Balancer → Conditions → Dynamic Condition
• Requirement None
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add.

2

Adım 2 Define the comparison

The Condition Name is entered, and Criteria = Dynamic Condition is selected. Condition Level = On Request is selected (only the conditions at the request stage are listed in Conditional Backend Services blocks); Condition Protocol is selected as HTTP or TCP according to the vService type. Neither field can be changed after saving. In the Query Key field, the Destination IP address variable is selected with fx; Operator = IP/cidr match is selected, and the network address and CIDR (e.g. 192.0.2.0 / 24) are entered in the IP/cidr to compare field.

3

Adım 3 Save the condition

The Add button is clicked.

4

Adım 4 Bind the condition

The condition is bound to a Conditional Backend Services block with steps 5–8 of Method 1, or to the Conditions field of an action as in Method 2.

Verification

1Address inside and outside the blockClient side

The same request is sent to an address in the block and to an address outside the block; the result is also read in the Connection Info line, as in Method 1.

Commandcurl -s http://192.0.2.10/ ; curl -s http://203.0.113.10/

ExpectedThe address inside 192.0.2.0/24 matches the condition; 203.0.113.10 does not

Common Mistakes

• Writing CIDR or more than one address in the Destination IP field. The field accepts a single address and compares it exactly. For several addresses, a separate condition is defined for each address and they are combined with or; for a network block, Method 3 is used.
• Confusing the destination address with the client address. Destination IP is a condition not on the client's address but on the vService address the client connects to; to separate by the client's address, the Source IP condition is used (Can I route only users coming from the internal network (specific IPs) to a test server?).
• Looking for the condition on the Network vService. The Destination IP condition is used only on HTTP and L7 TCP vServices.
• Putting two blocks for the same address. Conditional Backend Services blocks are evaluated from top to bottom and the first matching block is applied; a second block that covers the same address never runs (How do I change the evaluation order of Conditional Backend Services blocks?).
• Trying to separate by domain name using the address. If more than one domain name shares the same address, the separation cannot be done by address; the method in the Can I route based on the Host Header? question is used.

How it is done in the documentation

• Destination IP · What Is the Destination IP Condition?
• Destination IP · Destination IP
• HTTP (L7) vService · Conditional Backend Services
• HTTP (L7) vService · Frontend IP
• Dynamic Condition · Operator

Related questions

• Can I route only users coming from the internal network (specific IPs) to a test server?
• How do I combine multiple conditions with AND / OR?
• What are Dynamic Condition and Dynamic List used for?
• What is Content Switching?