Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the VPN IP category; why doesn't TR7 block VPN addresses by default?
Short answer
VPN IP is the IP reputation category that flags the addresses reported as belonging to a VPN server; this category is mostly flagged together with other categories. The default rules of IP Reputation Protection in Bot/DDoS protection deliberately leave the VPN IP category out: the first rule sends the attacker categories to quarantine, the second rule blocks all the remaining categories with 403 (Silent Drop on an L7 TCP vService), and VPN IP is in neither of them. The reason is the prevalence of legitimate use: a significant portion of corporate and individual users connect to the service over a VPN. If the same address is also flagged in another category, the rule of that category is applied to it. If desired, the VPN IP category can be added to the IP Reputation Protection rule list, to the Blacklist IP Category condition in the Load Balancer or to the WAF's Blacklist IP Category filter.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Settings → General Settings → IP Intelligence & Reputation | IP Categories → VPN IP (description: Conjunctive category.) | The number of addresses in the category |
| Bot/DDoS Management → IP Reputation Protection → Edit | IP Reputation Actions → Categories | Adding VPN IP to a rule row and binding an action (e.g. Show captcha) |
| Bot/DDoS Management → Bot Protection → Factors | Vpn Ip | The contribution of a VPN address to the bot score; its weight is deliberately very low |
| Load Balancer → Conditions | Blacklist IP Category = VPN IP | An action on VPN addresses with a vService rule |
| WAF Management → Whitelist & Blacklist | Blacklist Protection → Blacklist IP category | Which categories are used in the WAF's blacklist check |
Common Misconceptions
- "VPN addresses have a bad reputation." VPN use is widespread and mostly legitimate; for this reason, VPN IP is not in the default rules of IP Reputation Protection.
- "An address in the VPN IP category is never blocked." If the address is also flagged in another reputation category, the rule of that category is applied. The WAF's Blacklist Protection setting is on by default, and while Blacklist IP Category = All, it evaluates the whole blacklist without looking at the category; to keep VPN IP outside the WAF check, categories are selected with Filter.
- "The VPN IP category cannot be selected." The category can be selected in IP Reputation Protection, in the Blacklist IP Category condition and in the WAF filter; it has merely not been put into the default rules of IP Reputation Protection.
Handling VPN, Tor and data center addresses together: How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?
How it is done in the documentation
