How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?

Short answer

In the Whitelist & Blacklist window, one IP address or CIDR block is written on each line of the Frontend Blacklist field; requests coming from these addresses receive the 100-point Blacklisted IP violation only on this vService and are blocked in Blocking mode and recorded in Monitor mode. The addresses in the Frontend Blacklist Exclusions field are exempted from the matches of both this list and the IP Intelligence & Reputation blacklist; the requests of these addresses continue to pass through the WAF inspection, that is, this list is not a whitelist. Invalid lines are not applied. The two fields are visible and applied only while Blacklist Protection is on. For a single address, the Add to blacklist (vService name) and Add to whitelist (vService name) options in the menu next to the Attacker IP address on the Summary tab of an Event Logs record write to the same lists; when the address is added to one list, it is removed from the other. The setting is saved with Edit.

Problem: Specific Addresses Must Be Blocked Only on This vService or Exempted from the Blacklist

Attacker addresses specific to one application need to be blocked without affecting the other vServices on the device, or a legitimate address that is in the IP Intelligence & Reputation blacklist must not be blocked on this vService.

Solution: Three Methods

Your situation	Suitable method
I will edit multiple addresses in bulk	Method 1: Whitelist & Blacklist window
I will add a single address I saw in Event Logs	Method 2: Event Logs shortcut
I will write the list with the command line	Method 3: WEB-CLI

Method 1: Whitelist & Blacklist Window Recommended

• How it works The two lists are edited line by line; each line is an IP address or a CIDR block (IPv4 or IPv6).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Whitelist & Blacklist card → pencil icon
• RequirementBlacklist Protection on (it is on when WAF is turned on)
• Scope Only this vService

Step-by-Step Configuration

1

Adım 1 Open the Whitelist & blacklist window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Whitelist & blacklist card in the Inspection & Blocking section is clicked.

2

Adım 2 Turn on Blacklist protection (if needed)

If the Blacklist Protection switch is off, it is turned on; while it is off, the list fields are not visible.

3

Adım 3 Write the blacklist

The addresses to be blocked are written in the Frontend Blacklist field, one IP or CIDR on each line (e.g. 203.0.113.10 and 198.51.100.0/24). Addresses written on the same line with a comma or a space count as an invalid line and are not applied.

4

Adım 4 Write the exclusions (if needed)

The addresses to be exempted from the blacklist match are written in the Frontend Blacklist Exclusions field in the same way.

5

Adım 5 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Whitelist & blacklist cardTR7 side

The counter line on the Whitelist & blacklist card on the WAF Management tab is examined.

Expected2 pool-specific blocks and 0 exclusions are defined for this vService

2Event LogsTR7 side

A request is sent from the blacklisted address to the host group in Blocking mode, and the Event Logs record of the vService is examined.

ExpectedAttack blocked · Attack name: Blacklisted IP

Method 2: Event Logs Shortcut

• How it works The address in the record is added to the list or removed from the list with a single click; when the address is added to one list, it is removed from the other list.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs → record → Summary → Attacker IP → Actions
• RequirementBlacklist Protection on; while it is off, the Please turn on blacklist protection first error is given
• Scope Only this vService

Step-by-Step Configuration

1

Adım 1 Open the record

The record is clicked on the Event Logs screen of the vService; the Summary tab of the preview opens.

2

Adım 2 Open the address menu

The Actions menu next to the address in the Attacker IP row is clicked; the operation menu opens.

3

Adım 3 Select the operation

Add to blacklist (vService name) adds the address to the Frontend blacklist, and Add to whitelist (vService name) adds it to Frontend Blacklist Exclusions; if the address is already in the list, Remove from blacklist (vService name) or Remove from whitelist (vService name) appears in its place. The options that end with (IP intelligence) write to the device-wide lists (What is the difference between the vService blacklist and the IP intelligence list?).

4

Adım 4 Confirm

The Add this address to the blacklist of the service …? confirmation is accepted; the list is saved and applied.

Verification

1Address menuTR7 side

The menu in the Attacker IP row of the same record is opened again.

ExpectedRemove from blacklist (vService name)

The card counter also increases by one.

Method 3: WEB-CLI

• How it works The list field is written to the --blacklistIps or --blacklistExclusions field with WEB-CLI.
• Where it is opened WEB-CLI → waf options show · waf options update
• Requirement WEB-CLI access; Blacklist Protection on
• Limit The command writes the whole field, it does not add to the existing list; multi-line lists are entered with Method 1

Step-by-Step Configuration

1

Adım 1 See the existing list

waf options show poolId <vService>

The blacklistIps and blacklistExclusions lines show the existing lists; since the command will write in place of these lists, Method 1 is used if there is a filled list.

2

Adım 2 Write the list

For a single-address blacklist:

waf options update poolId <vService> --syncWithDefaultFwRules false --blacklistIps 203.0.113.10

The command gives no output. To write the same list to multiple vServices, waf options update-many is used (bulk update).

Verification

1Setting recordTR7 side

The WAF settings of the vService are displayed.

Command: waf options show poolId <vService>

ExpectedblacklistIps 203.0.113.10

Common Mistakes

• Thinking that Frontend blacklist exclusions is a WAF whitelist. An exempt address escapes only the blacklist match; it is still blocked with a signature or structural violation. For complete exemption from the inspection, Whitelist Condition is used (Does "Add to Whitelist (vService)" in Event Logs exempt an IP from WAF inspection, or does it only add a blacklist exclusion?).
• Expecting the lists while Blacklist protection is off. The fields are hidden and the lists are not applied; the saved values are preserved.
• Writing an address that concerns all vServices to each vService separately. For the whole device, the IP Intelligence & Reputation user blacklist is used (What is the difference between the vService blacklist and the IP intelligence list?).
• Writing the addresses on the same line. A line separated with a comma or a space counts as invalid and is not applied; one address is written on each line.
• Writing the connection address behind a proxy. If no Trusted proxy is defined on the vService, all requests appear to come from the proxy address.

How it is done in the documentation

• Whitelist & Blacklist · Frontend Blacklist
• Whitelist & Blacklist · Frontend Blacklist Exclusions
• Event Logs · Summary Tab
• WEB-CLI waf options · Blacklist

Related questions

• Can I blacklist an attacker IP directly from Event Logs (Attacker IP → Actions)?
• Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?
• What is the difference between the vService blacklist and the IP intelligence list?