Hello. I blocked some countries in the firewall from which my site was attacked. But I see these countries among the attackers again, even though it’s been 6 hours since they were blocked. What is the problem, why does the firewall allow traffic from blocked countries?
The same goes for AS num. I blocked some 6 hours ago, but still get an attack from them. At the same time, cloudflare itself shows which AS the attack is coming from, so it turns out that the service detects them correctly.
Did you filter the firewall action to Block and see the outcome?
I watch Firewall Events for the last 30 minutes. Need to do it differently?
Looks like you are showing all the firewall events, including the Allow ones.
Consider clicking the “Filter” button after you hover your mouse to the “Block” text:
If you see a lot of requests being blocked for the last 30 minutes, then your blocking rule should be working.
I think you’ve brought me to my senses and I’m beginning to understand. It turns out that the Firewall Events page displays absolutely all events, even those that failed due to Firewall rules?
Correct. This includes requests that are allowed, blocked, challenged, JS challenged, logged or bypassed by Cloudflare.
Thank you! You have solved my problem.
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.
