F5 iRules

DataDome F5 iRules integration detects and protects against bot activity.

This module is dedicated to be used on F5 iRules engine, for example at Big IP.

Before the regular process starts, an event is triggered and processes the DataDome logic in the iRules engine.

The module makes a call to one of our Regional Endpoints using a KeepAlive connection. Depending on the response, the module either blocks the request or allows the regular process to proceed.

The module has been developed to protect the visitors' experience: if any errors were to occur during the process, or if the timeout is reached, the module will automatically disable its blocking process and allow the regular process to proceed.

Compatibility

This module is compatible with Big IP >= 12

How to install and configure

  1. Login to your Admin console
  2. Download the latest distribution from the link here
  3. Create the DataDome-SSL-Helper iRule at: Local Traffic > iRules > iRule List > +
18561856
  1. Create a new pool that connects to the Geo-Proximity endpoint. Or if you prefer, select the closest API endpoint. List of endpoints.
18541854
  1. Create a new virtual server (Local Traffic > Virtual Servers > Virtual Server List > +) with the name datadome_api_ssl_vs and the following settings:
  • Destination address/mask: any un-routed IP
  • Service port: any un-used port.
  • Http Profile: http
  • Source Address Translation: Auto MAP
18391839
  1. To establish an SSL connection between Big IP and the DataDome API, use only the server SSL profile:
18361836

And then:

  • add the DataDome-SSL-Helper to the virtual server
  • assign the connection pool created in step 4
18381838
  1. Upload the DataDome iRule , and set the license key that is available in your DataDome dashboard.
18561856

If you want to use the Javascript injection method you should un-comment the corresponding block and set the JS Key.

  1. On the virtual server on which you want to add DataDome

Enable the streaming profile on the virtual servers for which you would like to use DataDome. To do that, go to Configuration, switch to Advanced and select any stream profile. Default stream is accepted.

517517

And then add the DataDome iRule

683683

Settings

SettingDescriptionRequiredDefault
DATADOME_LICENSE_KEYYour DataDome License keyYes
DATADOME_TIMEOUTThe request timeout for DataDome API, in millisecondsOptional150
DATADOME_URI_REGEXProcesses matching URIs onlyOptional
DATADOME_URI_REGEX_EXCLUSIONIgnores all matching URIsOptionalexclude static asset
DATADOME_jsA piece of JS code for injecting the DataDome tag to the page
(see https://docs.datadome.co/docs/protect-singlepage-app#ajax-listener)
Optional

FAQ

Can I have multiple iRules on my virtual server?

Yes, you can attach multiple iRules to a single virtual server and they will be executed following the defined order.

Although it is very difficult to control the GUI, it is made possible through TMSH.

You can update all iRules by assigning priority.

Two syntaxes are supported:

  1. Setup a global priority to the complete iRule
priority nnn
when <event_name> {
...
}

when <event_name> {
...
}
  1. Setup a local priority to a specified iRule's event:
when <event_name> priority nnn {
...
}

when <event_name> priority nnn {
...
}

It is possible to use a mix of both, but the second syntax will overwrite the first one.

Note that nnn is a value from 1 to 1000. By default each event has a value of 500.

Events are executed in order of priority from 1 to 1000. If more than one event have the same priority, they will be executed following the defined order.

Can I add another filter like a Host Header into the condition when DataDome is executed?

Yes, you can. You need to add your condition inside the HTTP_REQUEST event after set datadome_matched 0.