After you add your website to Web Application Firewall (WAF), you can configure an access control/throttling whitelist. Requests that match the specified conditions bypass detection by the following modules: HTTP flood protection, IP blacklist, scan protection, and custom protection policy. The whitelist also allows legitimate requests that are blocked because they trigger access control or throttling rules.
Prerequisites
-
You have activated a Web Application Firewall instance.
-
Your website has been added to WAF. For more information, see Tutorials.
Background
The access control/throttling feature lets you define custom, application-layer access control and traffic management policies to ensure your website's availability. It includes the following detection modules:
If these modules block legitimate requests to your website, you can configure an access control/throttling whitelist. This ensures that requests meeting the whitelist conditions bypass inspection by the specified modules.
As a best practice, define match conditions as precisely as possible to ensure that you allow only legitimate requests.
Procedure
-
Log on to the Web Application Firewall console.
-
In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).
-
Click the Access Control/Throttling tab, go to the Access Control/Throttling section, and click Configure Now on the right.
-
Create an access control/throttling whitelist rule.
-
On the Access Control/Throttling - Whitelist page, click Create.
-
In the Create Rule dialog box, configure the rule. Set Rule Name to a name of up to 50 letters, digits, or Chinese characters. Add up to five Match Conditions. A request is whitelisted only if it meets all conditions at the same time. For each condition, set a match field such as URL, a logical operator such as Contains, and match content. For Bypassed Modules, select at least one of CC Protection, Custom Rule, IP Blacklist, and Scan Protection. After you complete the configuration, click Save.
Parameter
Description
Rule Name
Enter a name for the rule.
Match Condition
Specify the conditions that a request must meet to be whitelisted. Click Add Condition to set up to five conditions. If multiple conditions exist, a request must meet all of them to be considered a match.
For more information about the fields in a match condition, see Fields in a match condition.
Bypassed Modules
Select the protection modules to bypass when a request matches the conditions. Available options are:
-
Default HTTP Flood Protection
-
Custom Rule
-
IP Address Blacklist
-
Scan Protection
-
-
Click Save.
The new whitelist rule is enabled by default. It appears in the rule list, where you can disable, edit, or delete it.
-