WAF not working

[duoclock]

Hi! Firewall rules do not work. How can this be? help solve the problem.

[domjh]

Do you want this to block both requests to both wp-admin and wp-login with the query string? If so then you probably want to switch from and to or. Currently it cannot match because it does not also dontain /wp-admin, only wp-admin.

[duoclock]

Thanks !!!

[duoclock]

It looks like the problem is not solved

[duoclock]

The full block of all ips works. Other ip permissions don’t work for me. I so understood to me someone replaces IP.

If you leave the rule “block admin” everything works fine. What do you recommend doing?)

[domjh]

I wonder if one of the higher rules is overriding it, if you move it to the top of the list does it work OK?

[duoclock]

Thanks! )

How can priority be affected?
On the other account, the priority is the same. Everything works great.

[duoclock]

I noticed that the priority does not work either. Watch the video.
firewall not working.

Google Disk

WAF not working.webm

[duoclock]

What to do with this phenomenon?? Is this a bug or am I doing something wrong?

[KianNH]

You’ve allowed IP addresses or URI Path containing admin - so it’ll never get blocked.

Change it to and, not or

[duoclock]

Thank you! Works!

[duoclock]

Again I see this problem. What about the Cloudflare service?

link video

WAF not work.webm

[duoclock]

what to do ? floating problem. This is the most important function in the CF service. Where else to write about my problem?

Allow IP url

Block URL

[jwds1978]

The issue isn’t with WAF. The issue is with your rules. Rule expressions · Cloudflare Ruleset Engine docs

In these screen captures, while you’ve blocked any URI with wp-admin in it, you’ve also allowed any URI with wp-admin in it. Which do you want to do, allow or block for wp-admin?

You’ve got two rules with the same match, but opposite actions, contradicting eachother. From what I assume you want to do with the “Allow admin ip” rule, you want the operator to be AND not OR.

With that said, you could combine both of those rules into a single rule, as below:

(
    http.request.uri.path contains "wp-admin"
    and not ip.src in {46.211.0.0/16}
)

[duoclock]

Thank you. Your version works.