WAF Block Rule doesn't actually block

Website, Application, Performance Security
1

What is the issue you’re encountering

I have created a Custom Rule (tried creating Rate limiting rule as well) where if someone access a specific URI it gets blocked. So far this works perfect, however the weird part is that the same IP can access other URI within the same domain. So for example i have created a rule to block when someone access cloud.trackerway.com/php.info and indeed you get blocked when you visit that URL. However at the same time if you try to access my homepage (cloud.trackerway.com) it will open the page fine. How exactly the block works here?

2

If I understand what you are asking correctly, the visitor will only be blocked or rate limited for the URI you specify, it doesn’t then block them from the site completely after hitting that URI if that’s what you are trying to do. The WAF works on a request-by-request basis and, other than rate limiting counting parameters, is stateless.

1 Like
3

When someone visits the specific URLS i have set, i know its 100% SPAM. So i want to immediately block that IP.

What’s the best path to do that?

1 Like
4

You could use a Worker or Snippet on the “trap” URI and add the IP address to a list which blocks the whole site by a WAF custom rule.

5

Nice idea, never used Workers before will definitely look to it. Thanks a lot!

1 Like
6

A rate limit is a bucket. When an IP address fills its bucket up, it won’t accept any more requests from that IP address.

Your bucket was example.com/that_one_URL. If the that_one_URL bucket fills up, they can’t make any more requests to that_one_URL, but they can still make requests to anything that’s not that bucket.

If your bucket was example.com, and they make requests to example.com/that_one_URL and example.com/that_other_URL, they will fill up the example.com bucket, so they won’t be able to make requests to example.com/yet_another_URL, because it’s part of the example.com bucket.

There is a Rate Limiting Worker feature in Open Beta:

And here’s another approach:

Keep in mind that using a Worker for rate limiting means that every single request to your website is going to count against your Workers request quota.

7

Yeah, I have same question, just like someone using hack to bypass the all redirect and waf defending rules, but finally got blocked by last layer of rule set.
I made myself a comprehensive plan to block all of scanner and crawler, only except for few permitted search engines.

8

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.