Web Application Firewall:Configure protection rules for the IP address blacklist module to block specific requests

Step 1: Create a protection template of the IP address blacklist module

The IP address blacklist module does not provide default protection templates. Before you can enable protection rules of the IP address blacklist module, you must create a protection template of the module and add protection rules to the template.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Basic Web Protection.

3. In the IP Address Blacklist section of the Basic Web Protection page, click Create Template.

   Note

   If this is your first time to create a protection template of the IP address blacklist module, you can also click Configure Now in the IP Address Blacklist card in the upper part of the Basic Web Protection page.

4. In the Create Template - IP Address Blacklist panel, configure the parameters and click OK. The following table describes the parameters.

   Parameter	Description
   Template Name	Specify a name for the template. The name of the template must be 1 to 255 characters in length and can contain letters, digits, periods (.), underscores (_), and hyphens (-).
   Save as Default Template	Specify whether to set the template as the default template for the protection module. You can specify only one default template for a protection module. If you turn on Save as Default Template, you do not need to configure the Apply To parameter. The default template is applied to all protected objects and protected object groups to which no custom templates are applied.
   Rule Configuration	Click Create Rule to create a protection rule for the template. You can also create protection rules after the template is created. For more information, see Step 2: Add protection rules to a protection template of the IP address blacklist module.
   Apply To	Select the Protected Objects and Protected Object Group to which you want to apply the template. You can apply only one template of a protection module to a protected object or protected object group. For more information about how to add protected objects and create protected object groups, see Configure protected objects and protected object groups.

   By default, a newly created protection template is enabled. You can perform the following operations on the protection template in the template list:

   • View the numbers of protected objects and protected object groups that are associated with the template in the Protected Object/Group column.

   • Turn on or turn off the switch in the Status column to enable or disable the template.

   • Click Edit or Delete in the Actions column to modify or delete the template.

   • Click the icon to the left of the template name to view the protection rules in the template.

     Note

     If you click Add to Blacklist for an attacker IP address on the Bot Management tab of the Security Reports page, WAF automatically creates a protection template named AutoTemplate in the IP address blacklist module and adds a protection rule whose Action is Block to the template. For more information, see Bot management module.

Step 2: Add protection rules to a protection template of the IP address blacklist module

A protection template takes effect only after you add protection rules to the template. If you created protection rules when you created the protection template, you can skip this step.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Basic Web Protection.

3. In the IP Address Blacklist section, find the protection template to which you want to add protection rules and click Create Rule in the Actions column.

4. In the Create Rule dialog box, configure the parameters and click OK. The following table describes the parameters.

   Parameter	Description
   Rule Name	Specify a name for the rule. The name of the rule can contain letters, digits, periods (.), underscores (_), and hyphens (-).
   IP Address Blacklist	Add IP addresses to the blacklist. After the rule takes effect, a request is blocked if the source IP address of the request is in the blacklist. Take note of the following items when you configure this parameter: You can enter IPv4 addresses and IPv6 addresses, such as 1.1.XX.XX and 2001:XXXX:ffff:ffff:ffff:ffff:ffff:ffff. You can enter IPv4 CIDR blocks and IPv6 CIDR blocks, such as 1.1.XX.XX/16 and 2001:XXXX:XXXX:XXXX::/64. You must press the Enter key each time you enter an IP address. You can enter up to 200 IP addresses.
   Action	Select the action that you want WAF to perform on the requests that match the rule. Valid values: Block: blocks a request that matches the rule and returns a block page to the client that initiates the request. Note By default, WAF returns a preconfigured block page. You can use the custom response feature to configure a custom block page. For more information, see Configure protection rules for the custom response module to configure custom block pages. Monitor: records a request that matches the rule in a log and does not block the request. You can query the logs of requests that match the rule and analyze the protection performance. For example, you can query logs to check whether normal requests are blocked. Important You can query logs only if the Simple Log Service for WAF feature is enabled. For more information, see Enable or disable the Simple Log Service for WAF feature. If you select Monitor, you can perform a dry run on the rule to check whether the rule blocks normal requests. If the rule passes the dry run, you can set the Action parameter to Block. Note On the Security Reports page, you can query the details of matched rules in Monitor or Block mode. For more information, see Security reports.

   By default, a newly created protection rule is enabled. You can perform the following operations on the protection rule in the rule list:

   • Turn on or turn off the switch in the Status column to enable or disable the rule.

   • Click Edit or Delete in the Actions column to modify or delete the rule.

What to do next

On the IP Address Blacklist tab of the Security Reports page, you can view the protection details of the configured protection rules. For more information, see IP address blacklist, custom rule, scan protection, HTTP flood protection, and region blacklist modules.

References

• Protection configuration overview: This topic provides information about protected objects, protection modules, and protection processes.

• CreateDefenseTemplate: You can call the CreateDefenseTemplate operation to create a protection template.

• CreateDefenseRule: You can call the CreateDefenseRule operation to create a protection rule. When you call this operation, you must set the DefenseScene parameter to ip_blacklist.