1

I have a CentOS 7.2 server with apache. I installed and configured modsecurity and I did some tests from my home and now my IP si blocked. Where is stored the blacklist for modsecurity? I stopped the iptables and fail2ban but I'm still blocked. Thanks

1 Answer 1

2

What you actually need to do is whitelist your IP

How do I whitelist an IP address so it can pass through ModSecurity? The first issue to realize is that in ModSecurity 2.0, the allow action is only applied to the current phase. This means that if a rule matches in a subsequent phase it may still take a disruptive action. The recommended rule configuration to allow a remote IP address to bypass ModSecurity rules is to do the following (where 192.168.1.100 should be substituted with the desired IP address):

SecRule REMOTE_ADDR "@ipMatch 192.168.110" phase:1,nolog,allow,ctl:ruleEngine=Off

If you want to allow uninterrupted access to the remote IP address,

however you still want to log rule alerts, then you can use this rule

SecRule REMOTE_ADDR "@ipMatch 192.168.110" phase:1,nolog,allow,ctl:ruleEngine=DetectionOnly

If you want to disable both the rule and audit engines, then you can optionally add another ctl action:

SecRule REMOTE_ADDR "@ipMatch 192.168.110" phase:1,nolog,allow,ctl:ruleEngine=Off,ctl:auditEngine=Off

See - https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-Frequently-Asked-Questions-%28FAQ%29#How_do_I_whitelist_an_IP_address_so_it_can_pass_through_ModSecurity

If you also run mod_evasive, also make sure that you create a whitelist for it too as it will also block you out as it is intended when you are wilfully attacking your own server.

2
  • Links to external resources are encouraged, but please add context around the link so your fellow users will have some idea what it is and why it’s there. Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. Dec 13, 2018 at 16:23
  • Thanks for the suggestion, I have updated by adding the relevant section as a blockquote.
    – MitchellK
    Feb 5, 2019 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .