WAF rules are not working for requests from the Philippines

Website, Application, Performance Security
1

What is the name of the domain?

depoint.app

What is the issue you’re encountering

all request coming from the Philippines can not be skipped and always get challenged

What steps have you taken to resolve the issue?

I created the most basic rule: (ip.src.country eq “PH”) or (ip.src.country eq “US”) and placed it first. It works for the US but does not work for PH.

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full

2

May I ask what’s the action you’ve used? :thinking: Was it “Skip”?

Does your Custom WAF Rule look like the example from below?:

slika
slika1088×1150 40.6 KB

If the requests trigger the Managed Rules, if you’re on a Free plan type, you can only add the IP Address(es) to the WAF → Tools → IP Access Rules with the action “allow” for your Website.

Otherwise, if you’re on a paid plan type, you can add an Exception Rule for the specific ruleID or rulesetID which you can determine by checking the triggered service and Security Events under the Security tab.

I’d suggest you to double-check the Security → Events at Cloudflare dashboard under your Cloudflare account for your zone, or via direct link https://dash.cloudflare.com/?to=/:account/:zone/security/events.

You should be able to see the challenged or blocked event under the Security tab → Events at Cloudflare dashboard for your zone and know exactly which security option was triggered.

Once you find them, click on a particular one to find more details about it (user-agent, IP, HTTP version …). If yes, could you share some details which service was triggered that blocked you?

3

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.