Web Application Firewall:Configure protection rules for the IP address blacklist module to block specific requests

Template types

Step 1: Create a protection template of the IP address blacklist module

The IP address blacklist module does not provide an initial default protection template. Before you can enable protection rules of the IP address blacklist module, you must create a protection template and add protection rules to the template.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Core Web Protection.

3. In the IP Address Blacklist section of the Core Web Protection page, click Create Template.

4. In the Create Template - IP Address Blacklist panel, configure the parameters and click OK.

   Parameter	Description
   Template Name	Specify a name for the template. The name of the template must be 1 to 255 characters in length and can contain letters, digits, periods (.), underscores (_), and hyphens (-).
   Save As Default Template	You do not need to specify protected objects for a default protection template. By default, all protected objects and protected object groups are selected. You can manually remove them from the default template. Only one default template can be specified for a protection module, and the default template can be specified only when you create a template. For the IP address blacklist module, you can also configure multiple protection templates for a single protected object or protected object group. For more information about how the templates take effect, see Examples of applying multiple protection templates.
   Rule Configuration	Click Create Rule to create a protection rule for the template. You can also create protection rules after the template is created. For more information, see Step 2: Add protection rules to a protection template of the IP address blacklist module.
   Apply To	Select items to which you want to apply the template on the Protected Objects and Protected Object Groups tabs. For more information, see Configure protected objects and protected object groups. A protected object or protected object group can be associated with multiple protection templates of the IP address blacklist module. If you set a default protection template, all protected objects and protected object groups are selected by default. If you do not set a default template, no protected objects or protected object groups are selected by default. You can manually modify the selection of protected objects and protected object groups.

   By default, a newly created protection template is enabled. You can perform the following operations on the template in the template list:

   • View the numbers of protected objects and protected object groups that are associated with the template in the Protected Object/Group column.

   • Turn on or turn off the switch in the Status column to enable or disable the template.

   • Click Create Rule in the Actions column to create a protection rule for the template.

   • Click Edit, Delete, or Copy in the Actions column to manage the template.

   • Click the icon to the left of the template name to view the protection rules in the template.

   Note

   When you view security reports, if you set the action for an attack in Bot management to Add To Blacklist, WAF automatically creates a protection template named AutoTemplate and adds a blacklist rule with the Block action. For more information, see Security Reports.

Step 2: Add protection rules to a protection template of the IP address blacklist module

A protection template takes effect only after you add protection rules to the template. If you created protection rules when you created the protection template, you can skip this step.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Core Web Protection.

3. In the IP Address Blacklist section, find the protection template to which you want to add protection rules and click Create Rule in the Actions column.

4. In the Create Rule dialog box, configure the parameters and click OK.

   Parameter	Description
   Rule Name	Specify a name for the rule. The name of the rule can contain letters, digits, periods (.), underscores (_), and hyphens (-).
   IP Address Blacklist	Add IP addresses to the blacklist. After the rule takes effect, if the source IP address of a request is in the blacklist, the request is blocked. The IP addresses must meet the following requirements: You can enter IPv4 addresses and IPv6 addresses, such as 1.1.XX.XX and 2001:XXXX:ffff:ffff:ffff:ffff:ffff:ffff. You can enter IPv4 CIDR blocks and IPv6 CIDR blocks, such as 1.1.XX.XX/16 and 2001:XXXX:XXXX:XXXX::/64. You must press the Enter key each time you enter an IP address. You can enter a maximum of 200 IP addresses.
   Action	Select the action that you want WAF to perform on the requests that match the rule. Valid values: Block: blocks a request that matches the rule and returns a block page to the client that initiates the request. Note By default, WAF returns a preconfigured block page. You can use the custom response feature to configure a custom block page. Monitor: records a request that matches the rule in a log and does not block the request. You can query the logs of requests that match the rule and analyze the protection performance. For example, you can query logs to check whether normal requests are blocked. Important You can query logs only if the Simple Log Service for WAF feature is enabled. If you select Monitor, you can perform a dry run on the rule to check whether the rule blocks normal requests. If the rule passes the dry run, you can set the Action parameter to Block. Note On the Security Reports page, you can query the details of matched rules in Monitor or Block mode. For more information, see Security reports.

   By default, a newly created protection rule is enabled. You can perform the following operations on the rule in the rule list:

   • View the rule ID and action in the Rule ID and Action columns.

   • Turn on or turn off the switch in the Status column to enable or disable the rule.

   • Click Edit or Delete in the Actions column to modify or delete the rule.

What to do next

On the IP Address Blacklist tab of the Security Reports page, you can view the protection details of the configured protection rules. For more information, see Security Reports.

References

• Protection configuration overview: This topic provides information about protected objects, protection modules, and protection processes.

• CreateDefenseTemplate: You can call this operation to create a protection template.

• CreateDefenseRule: You can call this operation to create a protection rule for the IP address blacklist module. When you call this operation, you must set the DefenseScene parameter to ip_blacklist and configure the rule content.