161
Appendix D
Configuration Files
In the following example, the first line specifies that all hosts are denied access to destination port 80 using
TCP. The second line specifies that host 209.1.2.2 is denied access to destination port 90 using UDP
deny tcp dport 80 src 0.0.0.0-255.255.255.255
deny udp dport 90 src 209.1.2.2
In the following example, the first line specifies that host 1.1.1.1 using source port 20 is allowed to
communicate with host 5.5.5.5 on destination ports 127-130 using TCP. The second line specifies that all hosts
are allowed to communicate with host 1.1.2.4 using UDP:
allow tcp src 1.1.1.1 dst 5.5.5.5 dport 127-130 sport 20
allow udp dst 1.1.2.4
bypass.config
The
bypass.config
file contains static transparency bypass rules (refer to
Static bypass rules‚ on page 32
for information about using static bypass rules). When the transparency option is enabled, the Traffic Server
uses the rules in the
bypass.config
file to determine whether to bypass incoming client requests or attempt
to serve them transparently.
You can configure three types of bypass rules:
The
bypass.config
file in the
Traffic Server’s config
directory also accepts dynamically generated
bypass rules. You can configure the Traffic Server to generate destination or source/destination bypass rules
in the following instances:
•
If there is a non-HTTP request on port 80
•
If an HTTP request returns the following errors:
o
400 Bad Request error
o
401 Unauthorized error
o
403 Forbidden error
o
405 Method not allowed error
o
406 Not Acceptable (access) error
o
408 Request timeout error
o
500 Internal server error
Rule
Description
Source bypass
Configures the Traffic Server to bypass a particular source IP address or range of
IP addresses. For example, use this solution to bypass clients that do not want to
use caching.
Destination bypass
Configures the Traffic Server to bypass a particular destination IP address or range
of IP addresses. For example, these could be destination servers that use IP
authentication based on the client’s real IP address.
NOTE:
Destination bypass rules prevent the Traffic Server from caching an entire
site. You will experience hit rate impacts if the site you bypass is popular.
Source/Destination
pair bypass
Configures the Traffic Server to bypass requests that originate from the specified
source to the specified destination. For example, you can route around specific
client-server pairs that experience broken IP authentication or out-of-band HTTP
traffic problems when cached. Source/destination bypass rules can be preferable to
destination rules because they block a destination server only for users that
experience problems.
