After you add web services to Web Application Firewall (WAF), you can configure custom rules to defend against specific requests. Custom rules include access control rules and throttling rules. This topic describes how to create a custom rule template and add custom rules to the template.
Background information
The following table describes access control rules and throttling rules.
Custom rule type | Description | Related configurations |
Access control rules | You can use common request header fields, such as the client IP address and request URL, to specify match conditions. If requests meet the specified match conditions, WAF performs a specific action on the requests. For example, you can configure a custom rule to block requests that are sent to a specific Uniform Resource Identifier (URI). You can also configure a custom rule to allow WAF to verify requests that contain a specific User-Agent string. |
For more information, see Step 2: Add a custom rule to a custom rule template. |
Throttling rules | You can specify request rate match conditions. If the request rate of a statistical object exceeds the upper limit, WAF performs a specific action on the requests that are sent from the statistical object. For example, if an IP address or a session frequently meets the match conditions in a short period of time, you can enable rate limiting to block requests that are sent from the IP address or session during a specific period of time. |
Prerequisites
A WAF 3.0 instance is purchased. For more information, see Purchase a subscription WAF 3.0 instance and Purchase a pay-as-you-go WAF 3.0 instance.
Web services are added to WAF 3.0 as protected objects. For more information, see Protected objects and protected object groups.
Step 1: Create a custom rule template
WAF does not provide a default custom rule template. Before you can create a custom rule, you must create a custom rule template.
Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and the region in which the WAF instance is deployed. You can select Chinese Mainland or Outside Chinese Mainland.
In the left-side navigation pane, choose .
In the Custom Rules section in the lower part of the Protection Rules page, click Create Template.
NoteIf no custom rule templates exist, click Configure Now in the Custom Rules card in the upper part of the Protection Rules page.
In the Create Template - Custom Rule panel, configure the parameters and click OK. The following table describes the parameters.
Parameter
Description
Template Name
Enter a name for the template.
The name of the template must be 1 to 255 characters in length and can contain letters, digits, periods (.), underscores (_), and hyphens (-).
Save as Default Template
Specify whether to set this template as the default template of the protection module.
You can set only one default template for a protection module. If you turn on Save as Default Template, you do not need to configure the Apply To parameter. The default template is applied to all protected objects and protected object groups to which no protection templates are applied.
Rule Configuration
Click Create Rule to create a custom rule for the template. You can also create custom rules for the template after the template is created. For information about how to create a custom rule, see Step 2: Add a custom rule to a custom rule template.
Apply To
Select the protected objects and protected object groups to which you want to apply the template.
You can apply only one template of a protection module to a protected object or a protected object group. For information about how to associate protected objects and protected object groups with the template, see Protected objects and protected object groups.
By default, a new rule template is enabled. You can perform the following operations in the rule template list:
View the number of protected objects and protected object groups that are associated with the template.
Turn on or turn off the switch in the Status column to enable or disable the template.
Click Edit or Delete in the Actions column to modify or delete the template.
Click the
icon to the left of a template name to view the rules in the template.
Step 2: Add a custom rule to a custom rule template
The custom rule template takes effect only after you add custom rules to the template. If you created custom rules when you create the template, skip this step.
Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and the region in which the WAF instance is deployed. You can select Chinese Mainland or Outside Chinese Mainland.
In the left-side navigation pane, choose .
In the Custom Rules section, find the custom rule template to which you want to add a custom rule and click Create Rule in the Actions column.
In the Create Rule dialog box, configure the parameters and click OK. The following table describes the parameters.
Parameter
Description
Rule Name
Specify a name for the rule.
The name of the rule can contain letters, digits, periods (.), underscores (_), and hyphens (-).
Match Condition
Specify the characteristics of requests that match the rule.
Click Add Condition to add a match condition. You can add up to five match conditions to a rule. If you add multiple match conditions, the rule is matched only when all match conditions are met.
Each match condition consists of Match Field, Logical Operator, and Match Content. Sample configurations:
Example 1: You set the Match Field parameter to URI, the Logical Operator parameter to Contains, and the Match Content parameter to
/login.php. If the requested URI contains/login.php, the request matches the rule.Example 2: You set the Match Field parameter to IP, the Logical Operator parameter to Belongs To, and the Match Content parameter to
192.1X.XX.XX. If a request is sent from a client whose IP address is192.1.XX.XX, the request matches the rule.
For more information about the match fields and logical operators, see Match conditions.
Rate Limiting
Specify whether to enable the rate limiting feature. If you enable the rate limiting feature and the requests that are sent from a statistical object frequently match a protection rule, WAF performs a specific action on the requests in a specific period of time.
ImportantThe rate throttling feature is used to limit the request rate of a statistical object for a protected object. For example, you add an Application Load Balancer (ALB) instance as a protected object and configure a throttling rule for the ALB instance. If the ALB instance forwards the requests of multiple domain names, the request rate is calculated based on multiple domain names. If you want to limit the request rate for a specific domain name, you can use one of the following methods:
Method 1: You can add the domain name as a protected object of WAF, and then configure a throttling rule for the domain name. For more information, see Protected objects and protected object groups.
Method 2: You can configure a throttling rule for the ALB instance and specify a match condition by using the Host request header to limit the request rate for the domain name.
If you enable the rate limiting feature, you must configure the rate limiting parameters.
Request rate detection conditions
If the number of times that a statistical object (Statistical Object) matches a protection rule within a specific statistical period (Statistical Interval (Seconds)) exceeds the upper limit (Threshold (Occurrences)), the object is added to a blacklist.
Status code detection conditions
If the number of times that a specific Status Code is included in responses exceeds the upper limit (Amount) or the percentage of a specific status code in all status codes that are included in responses exceeds the upper limit (Percentage(%)), the statistical object is added to a blacklist.
Conditions for adding a statistical object to a blacklist
If a statistical object matches the request rate detection conditions, the statistical object is added to a blacklist and remains in the blacklist for a specific period of time (Timeout Period). Then, WAF performs a specific action (Rule Action) on all requests from the protected object or only the requests that meet the match conditions (Apply To).
Protection Type
This parameter is automatically specified. The value of this parameter varies based on whether you turn on Rate Limiting.
If you turn on Rate Limiting, the Protection Type parameter has a fixed value of Throttling.
If you turn off Rate Limiting, the Protection Type parameter has a fixed value of Access Control.
Action
Select the action that you want WAF to perform when a request matches the rule. Valid values:
Block: blocks the requests that match the rule and returns a block page to the client.
NoteBy default, WAF uses a unified block page. You can use the custom response feature to configure a custom block page. For more information, see Configure custom response rules to configure custom block pages.
Monitor records the requests that match the rule in logs without blocking the requests. You can query logs about requests that match the rule and analyze the protection performance. For example, you can check whether normal requests are blocked based on logs.
ImportantYou can query logs only when the Log Service for WAF feature is enabled. For more information, see Enable or disable the Log Service for WAF feature.
If you select Monitor, you can perform a dry run on the rule to check whether the rule blocks normal requests. If the rule passes the dry run, you can set the Action parameter to Block based on your business requirements.
JavaScript Validation returns JavaScript code to the client. The JavaScript code can be automatically executed by the browser that is used by the client. If the client passes the JavaScript verification, WAF allows requests that are sent from the client within a specific time range. The default time range is 30 minutes. If the client fails the JavaScript verification, WAF blocks requests that are sent from the client.
CAPTCHA WAF returns pages that are used for slider CAPTCHA verification to the client. If the client passes the common slider CAPTCHA verification, WAF allows requests that are sent from the client within a specific time range. The default time range is 30 minutes. If the client fails the common slider CAPTCHA verification, WAF blocks requests that are sent from the client.
Strict Captcha WAF returns pages that are used for slider CAPTCHA verification to the client. If the client passes the strict slider CAPTCHA verification, WAF allows requests that are sent from the client. If the client fails the strict slider CAPTCHA verification, WAF blocks requests that are sent from the client. If you set the Action parameter to Strict Slider CAPTCHA, a client must pass strict slider CAPTCHA verification to send a request.
NoteCAPTCHA is supported only for subscription WAF instances of the Enterprise edition or Ultimate edition.
JavaScript Validation and CAPTCHA are applicable to only static pages. If you want responses to be compatible with asynchronous requests, such as requests that are initiated by using XMLHttpRequest and Fetch, you can enable JavaScript validation and common slider CAPTCHA when you configure the bot management module. For more information, see Enable and configure the bot management module.
Advanced Settings
Only pay-as-you-go WAF instances and subscription WAF instances of the Enterprise and Ultimate editions support Advanced Settings.
Canary Release: You can turn on Canary Release to apply the rule to a specific proportion of objects.
If you turn on Canary Release, you must configure the Dimension and Canary Release Ratio parameters. Valid values of the Dimension parameter: IP Address, Custom Header, Custom Header, Custom Cookie, and Session.
Effective Mode
Permanently Effective (default): If you select Permanently Effective, the protection rule is permanently in effect.
Fixed Schedule: You can specify a time zone and a period of time during which you want the template to be in effect.
Recurring Schedule: You can specify a time zone, days of the week, and a period of time in a day. The template is in effect during the same period of time in a day on the same days of the week.
By default, a new rule is enabled. You can perform the following operations in the rule list:
Turn on or turn off the switch in the Status column to enable or disable the rule.
Click Edit or Delete in the Actions column to modify or delete the rule.
What to do next
On the Custom Rule tab of the Security Reports page, you can view the protection details of the custom rule module. For more information, see IP address blacklist, custom rule, scan protection, HTTP flood protection, and region blacklist modules.
References
Protection configuration overview: describes the protected objects, protection modules, and protection procedures of WAF 3.0.
Match conditions: describes the match conditions and match fields that you can configure when you create a custom rule.
CreateDefenseTemplate: creates a protection template.
CreateDefenseRule: creates a protection rule. When you call this operation to create a custom rule, you must set the DefenseScene parameter to custom_acl.