CLIENT_ACCEPTED DESCRIPTION An iRule event triggered when a client has established a connection. In effect, when an entry is inserted in the BIG-IP connection table, this event fires. For TCP connections, this happens when the three-way handshake successfully completes. For non-TCP connections, this will fire at a point that may not be wholly intuitive. For example, UDP is connectionless, so one might reasonably expect this event to fire with each segment in a UDP stream. However, BIG-IP does create a connection table entry for UDP, and assigns a timeout. If no segment arrives matching the table entry within the timeout period, the entry is removed (and CLIENT_CLOSED fires). However, segments matching the table entry that arrive within the timeout period will not trigger a new CLIENT_ACCEPTED event (and will reset the timeout timer for the entry). The timeout is generally configured, in the case of UDP, via the UDP profile (or a child profile) applied to the virtual server. Some profile settings may also have an effect on when events are raised. For example, the "Datagram LB" setting on the UDP profile will force each segment in a UDP stream (that is, packets carrying UDP segments that all have a common source ip/port and destination ip/port) to load-balance. Between the BIG-IP system and the pool members, the forwarded segments will use different source port numbers for each segment (sort of like SNAT, but just for the port). In this case, CLIENT_ACCEPTED will fire for each segment. This is actually a specific case of the more general rule above, as each segment essentially creates an independent connection table entry. Notice, for example, that CLIENT_CLOSED will still fire for each segment after the timeout period. Examples when CLIENT_ACCEPTED { set curtime [clock seconds] set formattedtime [clock format $curtime -format {%H:%S} ] log "the time is: $formattedtime" HINTS SEE ALSO Access Control Based On IP This iRule forwards traffic based on "trusted" source addresses. Access Control Based On Network Or Host - This iRule allows administrators to allow or deny access to a virtual server based IP/networks and ports. This particular example is designed for use with an IP forwarding virtual server Apache Style Logging Slightly Modified - When SNATing to servers. the client IP is lost. BIG-IP Discard Server - Using TCP mblb profile and iRule to create a Null Virtual Server. Block requests by reverse DNS record - Performs a reverse DNS lookup to validate client IP Client Cert Request by URI with OCSP Checking - Request a client SSL certificate by URI and validate it using OCSP Client Auth Using HTTP Cookie - This iRule illustrates how to use HTTP Cookies for client based authentcation. Client Certificate Request by URI with OCSP Checking (v10.1 - v10.2.x) - Request a client SSL certificate by URI and validate it using OCSP for v10.1 - 10.2.x CMP v10.0 compatible counters using the session table - v10.0.1 CMP compatible global counter CSV Tabular Data Sideband Importer - This iRule adds the ability to import CSV- formatted tabular data to a table via an HTTP sideband connection. Destination Based Routing This iRule makes routing decisions based upon the destination address and whether that address is in on the the data groups called. This uses the matchclass method to try and match IP::local Destination Snat Using This iRule. selects a snatpool based on which virtual called the iRule. and will select the member servers to use based on DNS resolution. detect prior http redirect or respond - Detect a prior HTTP redirect or response to avoid a runtime TCL error Distribute Email By Source IP - I had a customer who wanted to use a single virtual IP address for a mail s... Excessive_404_Blacklist This iRule will block ALL further site access to source IP addresses that exceed a certain number of HTTP requests to server resources that results in a 404 not found error. Exchange2010 SNAT pool persistence - Applies a type of persistence per incoming IP to the SNAT pool masquerading IPs assigned to CAS RPC connections FIX Select Pool Based On Sender Comp ID - Financial Information eXchange (FIX) Protocol iRule to select pool based on Sender Comp ID. FTP Session Logging - Log FTP connection and username information How To Avoid SSL Handshake When No Pool Member Available - Rejects connection before handshake if no pool members are available HSRP and VRRP Optimization - This iRule translates the source MAC address in the lasthop entry to the Virtual MAC address of the VRRP/HSRP group HTTP sideband policy checking - iRule for HTTP sideband policy checking HTTP and HTTPS on a single virtual server - iRule to support a virtual server on port 0 and a client SSL profile. and a... HTTPS passthrough fallback URL - https://devcentral.f5.com/wiki/iRules.HuntTheWumpus.ashx - For all you "Hunt the Wumpus" fans out there. here's an iRule clone implemented on top of the FTP protocol. https://devcentral.f5.com/wiki/iRules.LDAPProxy.ashx - An LDAP proxy used send read/write requests to different pools. https://devcentral.f5.com/wiki/iRules.LimitConnectionsFromClient.ashx - Limit the number of TCP connections to a virtual server from client IP addresses. https://devcentral.f5.com/wiki/iRules.Log_client_to_vip_connections.ashx - This iRule generates an entry in a log file whenever somebody connects to a virtual server. https://devcentral.f5.com/wiki/iRules.LogEveryXSeconds.ashx - This example shows how to throttle log messages so a message is only logged every X number of seconds. https://devcentral.f5.com/wiki/iRules.LogHttpTcpUdpToSyslogng.ashx - You can use iRules to log a summary of each request and its response. and send the data to a remote syslog server using BIG-IP's syslog-ng daemon. https://devcentral.f5.com/wiki/iRules.MSMBypass.ashx - This iRule allows you to bypass MSM (Mail Security Module) for known-good senders. https://devcentral.f5.com/wiki/iRules.MySQL-Proxy.ashx - An MySQL proxy used send read/write requests to different pools. https://devcentral.f5.com/wiki/iRules.NAT64_DNS64.ashx - This actually contains 2 iRules. This is a solution that allows client from... https://devcentral.f5.com/wiki/iRules.NEDSRule.ashx - Used in conjunction with the NEDS specification contained in the Logging and Reporting Toolkit https://devcentral.f5.com/wiki/iRules.POST-Request-Exponential-Backoff.ashx - Exponential backoff iRule to thwart dictionary attacks https://devcentral.f5.com/wiki/iRules.ProxyAuth.ashx - Provides Authentication offload onto an service such as LDAP. https://devcentral.f5.com/wiki/iRules.RADIUSLoadBalancing.ashx - An iRule to load balance RADIUS requests. https://devcentral.f5.com/wiki/iRules.ratio_load_balancing_using_rand_function.ashx - Use a psuedo random number to set a ratio for any iRule logic. This avoids using a global counter mechanism to track past selections. https://devcentral.f5.com/wiki/iRules.ReverseProxyWithBasicSSO.ashx - The iRule implements a authenticated HTTPS reverse proxy. https://devcentral.f5.com/wiki/iRules.Route_Domain_Snat_and_Nat_Implementation.ashx - This iRule Provides Snat and Nat capabilities across route domains https://devcentral.f5.com/wiki/iRules.SelectiveSNAT.ashx - iRule that SNATS based on host address and port while just forwarding everything else. https://devcentral.f5.com/wiki/iRules.Sideband-connection-HTTP-example.ashx - Sends an HTTP request to a sideband server and parses the HTTP response headers and optionally the payload to determine which pool to send the client request to https://devcentral.f5.com/wiki/iRules.SingleNodePersistence.ashx - A really slick & reliable way to stick to one and only one server in a pool. https://devcentral.f5.com/wiki/iRules.SMTP_Start_TLS.ashx - allows either clear text or TLS encrypted communication with SMTP protocol https://devcentral.f5.com/wiki/iRules.SMTP-filter-and-forward-proxy.ashx - SMTP filter and forward proxy https://devcentral.f5.com/wiki/iRules.SMTPProxy.ashx - This iRule implements a simple SMTP proxy. - This iRule allows either clear text or TLS encrypted communication with the LTM initiating the encryption process if it sees the appropriate "starttls" command in the SMTP communication. https://devcentral.f5.com/wiki/iRules.snat_pool_persistence.ashx - This example shows how to select the same SNAT address for a given client IP address without tracking the selection in memory https://devcentral.f5.com/wiki/iRules.SOCKS5_SSL_Persistence.ashx - Much requested 2005 iRule contest winner (thanks Adam!) https://devcentral.f5.com/wiki/iRules.SUPL-ILP-Message-Based-Load-Balancing-with-Persistence.ashx - SUPL ILP message-based load-balancing https://devcentral.f5.com/wiki/iRules.TFTP_Server_as_iRule.ashx - This rule implements a very basic tftp server within an iRule. calling an https://devcentral.f5.com/wiki/iRules.TLS-ServerNameIndication.ashx - Server Name Indication (TLS SNI) allows dynamic selection of clientssl profiles and pools https://devcentral.f5.com/wiki/iRules.virtual_server_connection_rate_limit_with_tables.ashx - Limit the rate of connections to a virtual server to prevent overloading of pool members https://devcentral.f5.com/wiki/iRules.VPN_Sorter.ashx - An iRule that allows the sorting of VPN traffic to the various VPN servers ... https://devcentral.f5.com/wiki/iRules.Weblogic_JSessionID_Persistence.ashx - Provides persistence on the jsessionid value found in either the URI or a cookie. CHANGE LOG @BIGIP-9.0.0 --First introduced the event. BIG-IP 2019-05-10 iRule(1)