Configuring IP Address Blacklist and Whitelist Rules to Block or Allow Specified IP Addresses

Prerequisites

• The website to be protected has been added to WAF.
  • For cloud CNAME access mode, see Connecting a Website to WAF (Cloud Mode - CNAME Access).
  • For cloud load balancer access mode, see Connecting Your Website to WAF (Cloud Mode - Load Balancer Access).
  • For dedicated mode, see Connecting Your Website to WAF (Dedicated Mode).
• If you use a dedicated WAF instance, ensure that it has been upgraded to the latest version. For details, see Managing Dedicated WAF Engines.

Constraints

• When you add a website through Cloud Mode - Load balancer and set Frontend Protocol of the listener of your ELB load balancer to TCP, UDP, or QUIC, this type of rule does not take effect.
• WAF supports batch import of IP address blacklists and whitelists. You can use address groups to add multiple IP addresses/ranges quickly to a blacklist or whitelist rule. For details, see Adding an IP Address Group.
• For dedicated and cloud load balancer WAF instances, if the load balancers they use support IPv6 addresses, those WAF instances also support IPv6 addresses or IPv6 address ranges.
• You can configure 0.0.0.0/0 and ::/0 IP address ranges in WAF blacklist and whitelist rules to block all IPv4 and IPv6 traffic, respectively. A whitelist rule has a higher priority than a blacklist rule. If you want to allow only a specific IP address within a range of blocked addresses, add a blacklist rule to block the range and then add a whitelist rule to allow the individual address you wish to allow.
  

  If you want to allow only specified IP addresses to access the protected website, you can also configure rules b referring to How Do I Allow Only Specified IP Addresses to Access the Protected Website?

• If you set Protective Action to Block for a blacklist or whitelist rule, you can set a known attack source to block the visitor for a certain period of time; however, the known attack source with Long-term IP address blocking or Short-term IP address blocking configured cannot be set for a blacklist or whitelist rule. WAF will block requests matching the configured Cookie or Params for a block duration you specify.
• It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.

Specification Limitations

• For details about the quota for IP address blacklist and whitelist rules, see Edition Differences.
• If the quota for IP address whitelist and blacklist rules of your cloud WAF instance cannot meet your requirements, you can purchase rule expansion packages under the current WAF instance edition or upgrade your WAF instance edition to increase such quota.

  A rule expansion package allows you to configure up to 10 IP address blacklist and whitelist rules. For details about how to upgrade WAF specifications, see Upgrading the WAF Edition and Specifications.

Impact on the System

If an IP address is added to a blacklist or whitelist, WAF blocks or allows requests from that IP address without checking whether the requests are malicious.

Configuring an IP Address Blacklist or Whitelist Rule

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner and choose Web Application Firewall under Security & Compliance.
4. In the navigation pane on the left, choose Policies.
5. Click the name of the target policy to go to the protection configuration page.
6. Click the Blacklist and Whitelist configuration area and toggle it on or off if needed.
   • : enabled.
   • : disabled.

7. In the upper left corner above the Blacklist and Whitelist list, click Add Rule.
8. In the displayed dialog box, specify the parameters by referring to Table 1. Figure 1 and Figure 2 show two examples.
   

   • If you select Log only for Protective Action for an IP address, WAF only identifies and logs requests from the IP address.
   • Other IP addresses are evaluated based on other configured WAF protection rules.
   Figure 1 Adding an IP address/Range to a blacklist or whitelist rule
   

   Figure 2 Batching adding IP addresses/Ranges to a blacklist or whitelist rule
   

   Table 1 Rule parameters

   Parameter	Description	Example Value
   Rule Name	Rule name you entered.	waftest
   IP Address/Range/Group	You can select IP address/Range or Address Group to add IP addresses a blacklist or whitelist rule.	IP Address/Range
   IP Address/Range	This parameter is mandatory if you select IP address/range for IP Address/Range/Group. IP addresses or IP address ranges are supported. IP address: IP address to be added to the blacklist or whitelist IP address range: IP address and subnet mask defining a network segment NOTICE: Only the professional and platinum editions support IPv6 protection.	IPv4 format: 192.168.2.3 10.1.1.0/24 IPv6 format: fe80:0000:0000:0000:0000:0000:0000:0000 ::/0 XXX.XXX.2.3
   Select Address Group	This parameter is mandatory if you select Address group for IP Address/Range/Group. Select an IP address group from the drop-down list. You can also click Add Address Group to create an address group. For details, see Adding an IP Address Group.	groupwaf
   Protective Action	Block: Select Block if you want to blacklist an IP address or IP address range. Allow: Select Allow if you want to whitelist an IP address or IP address range. Log only: Select Log only if you want to observe an IP address or IP address range. Then, WAF determines whether the IP address or IP address range are blacklisted or whitelisted based on the events data.	Block
   Known Attack Source	If you select Block for Protective Action, you can select a blocking type of a known attack source rule. WAF will block requests matching the configured Cookie or Params for a length of time configured as part of the rule. NOTE: Do not select the Long-term IP address blocking for a long time or Short-term IP address blocking for Blocking Type.	Long-term Cookie blocking
   Rule Description	A brief description of the rule. This parameter is optional.	None
   Effective Date	You can select Immediate or set a custom time range. If the configured effective time expires, the Rule Status of the rule will change to Enabled (Invalid). You can change the effective time to make the rule work again or delete the rule.	Immediate

9. Click Confirm. You can then view the added rule in the list of blacklist and whitelist rules.
   • To disable a rule, click Disable in the Operation column of the rule. The default Rule Status is Enabled.
   • To modify a rule, click Modify in the row containing the rule.
   • To delete a rule, click Delete in the row containing the rule.

Protection Effect

To verify WAF is protecting your website (www.example.com) against a rule:

1. Clear the browser cache and enter the domain name in the address bar to check whether the website is accessible.
   • If the website is inaccessible, connect the website domain name to WAF by referring to Website Settings.
   • If the website is accessible, go to 2.

2. Blacklist the IP address of a client according to the instructions in Configuring an IP Address Blacklist or Whitelist Rule.
3. Clear the browser cache and access http://www.example.com. Normally, WAF blocks such requests and returns the block page.
4. Return to the WAF console. In the navigation pane, click Events. On the displayed page, view the event log.

Example Configuration - Allowing a Specified IP Addresses

If domain name www.example.com has been connected to WAF, you can perform the following steps to verify the rule takes effect:

1. Add a rule to block all source IP addresses.
   • Method 1: Add the following two blacklist rules to block all source IP addresses, as shown in Figure 3 and Figure 4.
     Figure 3 Blocking IP address range 1.0.0.0/1
     
     Figure 4 Blocking IP address range 128.0.0.0/1
     
   • Method 2: Add a precise protection rule to block all access requests, as shown in Figure 5.
     Figure 5 Blocking all access requests
     
   • Method 3: Add 0.0.0.0/0 and::/0 to block all IPv4 and IPv6 traffic.
     Figure 6 Blocking all IPv4 traffic
     
     Figure 7 Blocking all IPv6 traffic
     

2. Refer to Figure 8 and add a whitelist rule to allow a specified IP address, for example, XXX.XXX.2.3.
   Figure 8 Allowing the access of a specified IP address
   

3. Enable the white and blacklist protection.
   Figure 9 Blacklist and Whitelist configuration area
   

4. Clear the browser cache and access http://www.example.com.

   If the IP address of a visitor is not the one specified in 2, WAF blocks the access request. Figure 10 shows an example of the block page.

   Figure 10 Block page
   

5. Go to the WAF console. In the navigation pane on the left, choose Events. View the event on the Events page.