Configuring IP Address Blacklist and Whitelist Rules to Block Specified IP Addresses

Prerequisites

A protected website has been added. For details, see Adding a Website to EdgeSec.

Constraints

• EdgeSec supports batch import of IP address blacklists and whitelists. You can use address groups to add multiple IP addresses or IP address ranges quickly to a blacklist or whitelist rule. For details, see Adding a Blacklist or Whitelist IP Address Group.
• It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.
• The address 0.0.0.0/0 cannot be added to the IP address blacklist or whitelist. If you want to block all IP addresses within a range of blocked addresses, add a blacklist rule to block the range.
• If you configure Protective Action to Block for a blacklist or whitelist rule, you can configure a known attack source rule by referring to Configuring a Known Attack Source Rule. EdgeSec will block requests matching the configured IP address, Cookie, or Params for a length of time configured as part of the rule.

Precautions

• If you configure an IP address blacklist/whitelist rule in both EdgeSec and Content Delivery Network (CDN), the blacklist/whitelist rule in CDN is executed first.
• If the quota of IP address whitelist and blacklist rules of your EdgeSec instance cannot meet your requirements, you can purchase rule expansion packages under the current EdgeSec instance edition (a rule expansion package allows you to configure up to 10 IP address blacklist and whitelist rules) to increase such quota.

Impact on the System

If an IP address is added to a blacklist, EdgeSec blocks requests from that IP address without checking whether the requests are malicious.

NOTE:

After an IP address or IP address segment is added to the blacklist, CC attack detection is still performed.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Content Delivery & Edge Computing > CDN and Security.
3. In the navigation pane on the left, choose Edge Security > Website Settings. The Website Settings page is displayed.
4. In the Policy column of the row containing the domain name, click the number to go to the Policies page.
   Figure 1 Website list
   

5. In the Blacklist and Whitelist configuration area, change Status as needed and click Customize Rule.
   Figure 2 Blacklist and Whitelist configuration area
   

6. In the upper left corner of the Blacklist and Whitelist page, click Add Rule.
7. In the displayed dialog box, add a blacklist or whitelist rule, as shown in Figure 3.
   NOTE:

   • If you select Log only for Protective Action for an IP address, EdgeSec only identifies and logs requests from the IP address.
   • Other IP addresses are evaluated based on other configured EdgeSec protection rules.
   Figure 3 Adding a blacklist or whitelist rule
   

   Table 1 Rule parameters

   Parameter	Description	Example Value
   Rule Name	Rule name you entered.	EdgeSectest
   IP Address/Range/Group	You can select IP address/Range or Address Group to add IP addresses a blacklist or whitelist rule.	IP Address/Range
   IP Address/Range	This parameter is mandatory if you select IP address/range for IP Address/Range/Group. The value can be an IP address or an IP address range. IP address: IP address to be added to the blacklist or whitelist IP address range: IP address and subnet mask defining a network segment	XXX.XXX.2.3
   Select Address Group	This parameter is mandatory if you select Address group for IP Address/Range/Group. Select an IP address group from the drop-down list. You can also click Add Address Group to create an address group. For details, see Adding a Blacklist or Whitelist IP Address Group.	-
   Protective Action	Block: Select Block if you want to blacklist an IP address or IP address range. Log only: Select Log only if you want to observe an IP address or IP address range.	Block
   Known Attack Source	If you select Block for Protective Action, you can select a blocking type of a known attack source rule. EdgeSec will block requests matching the configured IP address, Cookie, or Params for a length of time configured as part of the rule.	Long-term IP address blocking
   Rule Description	A brief description of the rule. This parameter is optional.	None

8. Click OK. You can then view the added rule in the list of blacklist and whitelist rules.
   • To disable a rule, click Disable in the Operation column of the rule. The default Rule Status is Enabled.
   • To modify a rule, click Modify in the row containing the rule.
   • To delete a rule, click Delete in the row containing the rule.