Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?

Short answer

Yes. Blacklist Protection comes on when WAF is turned on, and All is selected in the Blacklist IP Category field. While it is on, the blacklist categories of IP Intelligence & Reputation and the vService-specific Frontend Blacklist are evaluated together; a request from an address on the list receives a 100-point Blacklisted IP violation. Since 100 points exceed every OWASP Protection Level threshold, the request is blocked in Blocking mode and only recorded in Monitor mode; it is not blocked in Learning mode and in a request that comes with the Teacher identity, and in Learning mode no Event Logs record is created either. By selecting Filter in the Blacklist IP Category field, only specific categories (User blacklist, External, DDoS Attack, Web App Attack …) can be used. Since requests that match the Whitelist do not enter WAF, they do not enter the blacklist check either; the addresses in Frontend Blacklist Exclusions are exempted from the blacklist match.

Problem: Known Bad Sources Reach the Application

Attack infrastructures, bad bots and addresses with a bad reputation can probe the application even without triggering a signature. Requests from these sources are to be blocked before they reach the Backend Service.

Solution: Two Methods

The two methods write the same settings; one of them is selected. Adding addresses manually for this vService only is described on the How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)? page.

Your situation	Suitable method
I will set the protection and the categories from the interface	Method 1: Whitelist & Blacklist window
I will set them with a script or the command line	Method 2: WEB-CLI

Method 1: Whitelist & Blacklist Window Recommended

• How it works The blacklist protection and the categories to be used are selected across the vService.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Whitelist & Blacklist card → pencil icon
• Requirement WAF-enabled HTTP vService; blacklist data in IP Intelligence & Reputation
• Default Blacklist protection on · Blacklist IP Category: All

Step-by-Step Configuration

1

Adım 1 Open the Whitelist & blacklist window

In Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Whitelist & blacklist card in the Inspection & Blocking section is clicked (Whitelist & blacklist Edit screen).

2

Adım 2 Turn on Blacklist protection

The Blacklist Protection switch is turned on (it is already on when WAF is turned on). While the switch is off, the Blacklist IP Category, Frontend Blacklist and Frontend Blacklist Exclusions fields are not visible.

3

Adım 3 Determine the category selection

If the Blacklist IP Category switch is left in the All position, all categories are used. For specific categories only, the switch is set to the Filter position.

4

Adım 4 Select the categories (if Filter was selected)

Categories are selected from the list that opens (e.g. User Blacklist, Web App Attack); at least one category must be selected. The categories are the same as the categories in IP Intelligence & Reputation (supported categories); User Blacklist is the blacklist maintained manually on the device.

5

Adım 5 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Whitelist & blacklist cardTR7 side

The Whitelist & blacklist card on the WAF Management tab is examined.

ExpectedRequests from bad-reputation source IPs are blocked — category: User blacklist, Web App Attack

While All is selected, the sentence ends with category: All.

2Event LogsTR7 side

A request is sent from an address in a selected category to the host group in Blocking mode, and the Event Logs record of the vService is examined.

ExpectedAttack blocked · Attack name: Blacklisted IP

Method 2: WEB-CLI

• How it works The protection and the categories are written to the --blacklistProtection and --blacklistProtectionCategories fields with WEB-CLI.
• Where it is opened WEB-CLI → waf options show · waf options update
• Requirement WEB-CLI access
• Scope Across the vService

Step-by-Step Configuration

1

Adım 1 See the current selection

waf options show poolId <vService>

If blacklistProtectionCategories is empty (All), all categories are in use; if the list is filled, the saved categories appear with their index numbers. The command changes only the index numbers that are written; if another category remains in the list, it also continues to be used.

2

Adım 2 Write the protection and the categories

waf options update poolId <vService> --syncWithDefaultFwRules false --blacklistProtection true --blacklistProtectionCategories.0 user --blacklistProtectionCategories.1 webAppAttack

Category values are written as IDs, such as user (User blacklist), external (External), dDoSAttack (DDoS Attack), webAppAttack (Web App Attack), bruteForce (Brute-Force), sqlInjection (SQL Injection) and badWebBot (Bad Web Bot). The command gives no output. Returning to all categories (All) is done with the Blacklist IP Category switch in the interface.

Verification

1Setting recordTR7 side

The WAF settings of the vService are displayed.

Command: waf options show poolId <vService>

ExpectedblacklistProtection true · blacklistProtectionCategories user, webAppAttack

Common Mistakes

• Assuming that the blacklist data is updated on its own. Online Update Period in IP Intelligence & Reputation is off by default (Off); data that is not updated does not contain new bad addresses.
• Expecting a blacklist block in Learning mode. In Learning mode, the 100 points of a blacklist match are still added to the total, but no blocking decision is made; signature hits are not added to the score (What does the WAF do in Learning mode; are attacks blocked?).
• Thinking that Frontend blacklist exclusions is a WAF exemption. The addresses in this list are exempt only from the blacklist match; their requests are still inspected by WAF. For a complete exemption from inspection, Whitelist Condition is used (Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?).
• Thinking that this setting is common to all vServices. The setting manages only the WAF inspection of this vService; to use the blacklist outside WAF, conditions and the Bot/DDoS layer are set separately (Can I block known malicious IPs (IP Reputation / blacklist category)?).

How it is done in the documentation

• Whitelist & Blacklist · Blacklist Protection
• Whitelist & Blacklist · Blacklist IP Category
• Blacklist IP Category · Supported IP Intelligence Categories
• WEB-CLI waf options · Blacklist

Related questions

• How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?
• What is the difference between the vService blacklist and the IP intelligence list?
• Can I block known malicious IPs (IP Reputation / blacklist category)?