I'm try to add Google Ip range on white list for Mod Security

I use Cpanel+Apache 2.4+ModSecurity 2.9.0+OWASP Rules

On several post i se this conf

SecRule REMOTE_ADDR "@ipMatch XX.XX.XX.XX," "phase:1,nolog,allow,ctl:ruleEngine=Off"

But fail Only work if add a id:rule

SecRule REMOTE_ADDR "@ipMatch XX.XX.XX.XX," "phase:1,id:'981033',t:none,nolog,pass,ctl:ruleEngine=Off"

Ids became mandatory in ModSecurity 2.7: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#id

So guessing the posts you picked this up from there predate this.

Note you should use an id in the range 1-99,999 and not 981033 which is reserved for the OWASP CRS rules.

  • Only one question. Curios. File of example crete by OWASP ModSecurity, show this rules. But if activate file example, get error goo.gl/UEyU8q I'm lost
    – abkrim
    Aug 22 '16 at 4:31
  • What error do you get? Aug 22 '16 at 5:28
  • On link get rules and show error
    – abkrim
    Aug 22 '16 at 6:17
  • Missed that. So error is "Found another rule with same id". And I've already told you in my answer not to use id 981033 because it's reserved and so will already be used if you use the OWASP CRS. So just change the id of the rule you created to an id less than 100,000. Aug 22 '16 at 6:22
  • Are you read content of file ? This file it's created By OAWSP, and this file containt examples for use file (commented) . File it's for HOLD LOCAL EXCEPTIONS and need ID rule what you like short-circuit and allow. Read more lines put #EXAMPLE...and original example has a OWASP Rule ID 981033. Why OWASP put an example with rules of OWASP?
    – abkrim
    Aug 22 '16 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.