Add WAF rule to block specific countries from wp-admin and wp-login

[matthew.giannelis]

Hello

I am trying to work out how to create WAF to block chosen counties from access to wp-admin and wp-login but I dont know how to write the expression

Can someone please post it here.

Thanks

[fritex]

Greetings,

Thank you for asking.

You’d need only for wp-login.php as far as /wp-admin/ is doing a redirection.
Furthermore, blocking resources from /wp-admin/ directory or locking them isn’t very usefull.

Example to restrict the access from multiple countries to the wp-login.php:
(ip.geoip.country in {"BA" "HR" "RS" "SI"} and http.request.uri.path contains "wp-login.php")

In my case, I usually have 2 Firewall Rules:

1. Block all the request except if the request is coming from my country
2. JS challenge all requests (just in case) - no need to add “from my country” here as I checked them using 1st rule already

As an example, in picture:

Expression:
(ip.geoip.country ne "HR" and http.request.uri.path contains "wp-login.php")

As an example, in picture:

Expression:
(http.request.uri.path contains "wp-login.php")

On the Firewall Rules list, this is how it looks:

Since you’re using WordPress, I’d suggest my post here as it contains a lot useful stuff:

What Request to Block in Firewall for Wordpress and Normalize URLs

That is a good question out there. I would say it cannot be stated as a general rule of thumb, as far as some WordPress websites do not have to use like POST or PUT (WP REST API, wp-json, plugins etc.), while other have to - just an example. You could try to block TRACE & TRACK for example. Or, if you could for example, limit HEAD, GET and POST for some specific IP or some similar scenario, where you protect your Website from bad bots, possible attacks, etc. in terms of security measurements. …

[matthew.giannelis]

Hi there

So I should challeange my own country which is the only one I will be leaving open?

right?

[matthew.giannelis]

Hi there

Sorry I was using only URL and not URL PATH

However, wordfence block is kicking in instead. Not the Cloudflare blocking

I beleive these counties I added should be seeing the Cloudflare blocking first no matter what

[matthew.giannelis]

@fritex

wp-login.php

Hi thanks for the info.

I have done a test and configured the first part as such

(ip.geoip.country in {“AF” “AX” “AL” “DZ” “AS” “AD” “AO” “AI” “AG” “BD” “BW” “BR” “CO” “CG” “DK” “FJ” “IN” “MV” “PH” “RU” “SE” “AE” “GB” “US” “NL”} and http.request.uri eq “wp-login.php”)

Now strange thing

I also have wordfence plugin county blocking installed and running. In Cloudflare I have blocked Russia. I then connect to russia via VPN. I try to access to access wp-login from russia and the wordfence blocking page kicks in. Should that country not actually see the couldflare blocking page first?

This is an indication to me that my Cloudflare country blocking is not working. I would have thought they would see the Cloudflare blocking page first instead of the wordfence blocking page.

I have wordfence blocking in place also in case they get around the firewall IP and know my origin server IP

[fritex]

@matthew.giannelis

I also have wordfence plugin county blocking installed and running

@matthew.giannelis

an indication to me that my Cloudflare country blocking is not working

Regarding Wordfence and Cloudflare, make sure to correctly configure Wordfence to work with Cloudflare proxy to return the correct visitor IP address under the Global Options - > CF-Connecting-IP:

Global Options - Wordfence

@matthew.giannelis

I have wordfence blocking in place also in case they get around the firewall IP and know my origin server IP

Nevertheless, maybe you’d need to check below article too:

• Restoring original visitor IPs

I’d also suggest you to whitelist the origin host/web server IP at Cloudflare → Security → WAF → Tools → IP Access Rules with the action “allow” for your Website.

[matthew.giannelis]

Hello

Thank you for this.

Can I ask. If I am using this setting, but an attacker knows my server IP and goes around Cloudflare, then the wordfence country block would no longer work right?

[sdayman]

@matthew.giannelis

Can I ask. If I am using this setting, but an attacker knows my server IP and goes around Cloudflare, then the wordfence country block would no longer work right?

Wordfence would catch this, as it always has.