Configuring an IP Address Blacklist or Whitelist Rule

Prerequisites

A website has been added to WAF.

Constraints

• WAF does not support batch import of blacklists or whitelists. To configure multiple IP address or IP address range rules, add blacklist and whitelist rules one by one to allow or block specified IP addresses or IP address ranges.
• It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.

Impact on the System

If an IP address is added to a blacklist or whitelist, WAF blocks or allows requests from that IP address without checking whether the requests are malicious.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
4. In the navigation pane, choose Website Settings.
5. In the Policy column of the row containing the target website, click the number to go to the policy configuration page.
6. In the Blacklist and Whitelist configuration area, change Status as needed and click Customize Rule.
   Figure 1 Blacklist and Whitelist configuration area
   

7. In the upper left corner of the Blacklist and Whitelist page, click Add Rule.
8. In the displayed dialog box, specify the parameters by referring to Table 1.
   

   • If you select Log only for Protective Action for an IP address, WAF only identifies and logs requests from the IP address.
   • Other IP addresses are evaluated based on other configured WAF protection rules.
   Figure 2 Adding a blacklist or whitelist rule
   

   Table 1 Rule parameters

   Parameter	Description	Example Value
   Rule Name	Rule name you entered.	WAF
   IP Address/Range	IP addresses or IP address ranges are supported. IP address: IP address to be added to the blacklist or whitelist IP address range: IP address and subnet mask defining a network segment	XXX.XXX.2.3
   Protective Action	Block: Select Block if you want to blacklist an IP address or IP address range. Allow: Select Allow if you want to whitelist an IP address or IP address range. Log only: Select Log only if you want to observe an IP address or IP address range. Then, WAF determines whether the IP address or IP address range are blacklisted or whitelisted based on the events data.	Block
   Known Attack Source	If you select Block for Protective Action, you can select a blocking type of a known attack source rule. WAF will block requests matching the configured IP address, Cookie, or Params for a length of time configured as part of the rule.	Long-term IP address blocking
   Rule Description	A brief description of the rule. This parameter is optional.	None

9. Click OK. You can then view the added rule in the list of blacklist and whitelist rules.
   Figure 3 Blacklist or whitelist rules
   
   • To disable a rule, click Disable in the Operation column of the rule. The default Rule Status is Enabled.
   • To modify a rule, click Modify in the row containing the rule.
   • To delete a rule, click Delete in the row containing the rule.

Protection Effect

If you have added domain name www.example.com to this rule, to verify WAF is protecting the corresponding website:

1. Clear the browser cache and enter the domain name in the address bar to check whether the website is accessible.
   • If the website is inaccessible, connect the website domain name to WAF by following the instructions in Step 1: Add a Website to WAF.
   • If the website is accessible, go to Step 2.

2. Blacklist the IP address of a client according to the instructions in Procedure.
3. Clear the browser cache and access http://www.example.com. Normally, WAF blocks such requests and returns the block page.
4. Return to the WAF console. In the navigation pane, choose Events. On the displayed page, view or download events data.