whereis¶

whereis <ip> [country | continent | state | abbrev | city | zip | area_code |
   latitude | longitude | isp | org | country_cf | state_cf | city_cf | proxy_type]+

when DNS_REQUEST {
  if {[whereis [IP::client_addr]] contains "Asia"} {
    pool asia_pool
  } else {
    pool general_pool
  }
}

when DNS_REQUEST {
   log local0. "IP [IP::client_addr] is in \
      continent [lindex [whereis [IP::client_addr]] 0] and \
      country [lindex [whereis [IP::client_addr]] 1]"
}

IP x.x.x.x is in continent North America and country US

when DNS_REQUEST {
   log local0. "IP [IP::client_addr] is in \
      continent [whereis [IP::client_addr] continent] \
      and country [whereis [IP::client_addr] country]"
}

IP x.x.x.x is in continent North America and country US

proc geoloc_mod {latitude longitude} {
  return [list [expr {$latitude / 10000.}] [expr {$longitude / 10000.}]]
}
when HTTP_REQUEST {
  set lat [whereis [IP::client_addr] latitude]
  set lon [whereis [IP::client_addr] longitude]
  if { [string is integer $lat] && [string is integer $lon] } {
    #use proc to convert geolocation from strings to degrees, store in a list
    set geoloc_deg [call geoloc_mod $lat $lon]
  }
  log local0. "Latitude: [lindex $geoloc_deg 0], Longititude: [lindex $geoloc_deg 1]"
}

when CLIENT_ACCEPTED {
   log local0. "Got client: [whereis [IP::client_addr] country continent state city zip]"
}

# ========================================================================================
# For clients coming from a country in a greylist data group,
# Limit each client IP address to 1800 concurrent connections over a 180 second window
# If the client closes the connection, the count is immediately decremented.
# Else the count is decremented after the window times out for that connection.
#
# Greylist countries must be listed in the data group as the ISO3166 2 character
# http://www.iso.org/iso/country_codes/iso_3166_code_lists/country_names_and_code_elements.htm
when RULE_INIT {

    # Max number of connections for a client over an interval
    set static::max_conns 1800

    # Timeout for still counting a connection that has not been closed yet
    set static::interval 180

    # Name of data group containing 2 character ISO3166 country codes to limit connections for
    set static::greylist_dg "greylist_country_codes_dg"

    # Syslog pool
    set static::syslog_pool "udp_syslog_pool"

    # Syslog protocol (must be exactly TCP or UDP in uppercase)
    set static::syslog_proto "UDP"
}
when CLIENT_ACCEPTED {

    # Exit the iRule and do not check the connection rate if the client is not from a greylist country
    set country [whereis [IP::client_addr] country]
    if {$country ne ""}{

        # Check if the country is not in the grelist data group
        if {[class match $country equals $static::greylist_dg]}{

            # Exit this iRule event to prevent non-greylist IPs from being limited
            return
        }
    }

    # Set a subtable name with a standard prefix and the client IP
    set tbl "connlimit:[IP::client_addr]"

    # Check if the subtable has over X entries
    if { [table keys -subtable $tbl -count] >= $static::max_conns } {

        # Send a remote syslog message using local0.notice <133>
        # see RFC 3164 Section 4.1.1 - "PRI Part" for more info
        #HSL::send [HSL::open -proto $static::syslog_proto -pool $static::syslog_pool] "<190> [info hostname] [IP::local_addr]: Hit connection limit: [IP::client_addr]"

        # Drop the connection
        # drop

        # Or apply a rateclass
        # rateclass rateclass1

    } else {

        # Add the client IP:port to the client IP-specific subtable
        #   with a max lifetime of X seconds.
        # Use a key of the client IP:port
        set key "[IP::client_addr][TCP::client_port]"
        table set -subtable $tbl $key "ignored" $static::interval
    }
}

when CLIENT_CLOSED {
    # When the client connection is closed, remove the table entry
    table delete -subtable $tbl $key
}