Hello, I am looking for some help with evaluating Responder policies. I am looking into adding a condition to the responder policy which would take in consideration the client IP address. The condition would be: "If the request originates from 111.222.333.444 and the requested URL contains test" and the action would be something like "forward to google.com". When evaluating the policy I am using a HTTP Request in the following form: GET /test/tutorials/linux/shellscripts/howto.html HTTP/1.1 Host: Linode.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.8) Gecko/20091102 Firefox/3.5.5 Accept: text/html,application/xhtml+xml, Accept-Language: en-us Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8 Cache-Control: no-cache However I don't find a way to add the Source IP for the condition: CLIENT.IP.SRC. Do any of you know how could I add this? Thank you for your help.

I don’t think the evaluator supports checking the source IP

You might need to enable client-ip in the connection to capture that as a header you can use to evalutate.

@Jeff Riechers I am under AppExpert/Responder/Policies at that point I cannot see the client-ip information. I can use HTTP headers only but I cannot find one that would work. Trying to evaluate the condition I am getting: "Invalid expression [IPv4 address]". I am leaning towards @Kari Ruissalo (WyW)’s opinion and believe there might actually not be an option to evaluate

Jeff’s got a point, but I don’t think it applies to your use case

What is the responder being bound to? a LB? CSW? You would have to capture it before the responder evaluation in order to use it.

Yeah, I don't seem to be able to use that bit in the responder policy. I tried also with X-Forwarded-For but the evaluator doesn't like that either

you could use sth like

http.req.url.contains("test") && client.ip.src.eq(111.222.333.444)

so would be something like bellow and it is under AppExpert>Responder>Responder Policicy

the evaluator doesn't work, but the expression should, I'm using it like that in many many places

yeah, that might be easier to do it through ssh as you say as in the GUI it can get confusing.

you can even use an expression with patternset or just dataset to have several ip addresses and/or ranges

cool, thank you both for your help

ofc the originating IP must show for NetScaler, so if you have a NAT configuration that masks the source IP, it doesn't work

cool, thank you again for your help