Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is an open proxy; what does TR7 do by default with addresses in this category?
Short answer
An open proxy is a proxy or relay server that relays anyone's traffic without requiring authentication; attackers use it to hide their real addresses. The Open Proxy category in TR7's IP reputation database covers the addresses reported as open proxy, open relay and Tor exit node. When Bot/DDoS protection is turned on for a vService, IP Reputation Protection starts in Active mode, and its default first rule sends Open Proxy to quarantine together with the DDoS Attack, Hacking, SQL Injection, Brute-Force, Web App Attack, Exploited Host, Bad Web Bot and User Blacklist categories; for the duration on the Quarantine card (30 minutes by default), the default Silent Drop action is applied to the source. On a vService where WAF protection is on, the WAF's Blacklist Protection setting, which is on by default (Blacklist IP Category = All), evaluates the whole blacklist, including Open Proxy; a hit is blocked only in Blocking mode. On vServices where neither of the two is on, the category is used with the Blacklist IP Category condition in the Load Balancer.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Settings → General Settings → IP Intelligence & Reputation | IP Categories → Open Proxy | The number of addresses in the category and its description (Open proxy, open relay, or Tor exit node.) |
| Bot/DDoS Management → IP Reputation Protection | Default Rules → row 1, action Quarantine | Putting the addresses in the category into quarantine |
| Bot/DDoS Management → Bot Protection → Factors | Open Proxy | The contribution of an address in the category to the bot score |
| Load Balancer → Conditions | Blacklist IP Category = Open Proxy | An action on this category with a vService rule |
| WAF Management → Whitelist & Blacklist | Blacklist IP category | Limiting the Blacklist protection check to the selected categories |
Common Misconceptions
- "Every client that uses a proxy is an open proxy." Corporate proxies and CDNs are not open to everyone; the category covers servers that have been left open to everyone and have been reported as abused.
- "By default, it is blocked only with 403." In the default rules of IP Reputation Protection, Open Proxy is not in the second row, which blocks with 403, but in the first row, which sends to quarantine.
- "This category is blocked automatically on every vService." The default enforcement is applied only on vServices where Bot/DDoS protection (IP Reputation Protection) or WAF protection (Blacklist protection) is on (in WAF, the request is blocked only in Blocking mode; it is not blocked in the Learning, Monitor and Teacher modes); on the other vServices, the category is used with the Blacklist IP Category condition.
- "An address that is listed by mistake continues to be blocked." When the address is added to the IP Intelligence & Reputation Whitelist Content list, it is exempted in all layers; to exempt it only on a single vService, the whitelist fields of IP Reputation Protection are used.
How it is done in the documentation
