Questions tagged [web-application-firewall]
generic term for set of software, web server extensions or hardware designed to filter WWW traffic at the application level in TCP network model.
49
questions
0
votes
0
answers
31
views
How do i nessus scan to the EC2 server which is behind load balancer
I have a EC2 server which is running behind a load balancer. Load balancer URL has been mapped as A record in route53.
Audit team is asking for the public ip address. How do i give them?
ALB URL even ...
0
votes
1
answer
278
views
How to add ip address to a whitelist wfa rule in azure using azure cli?
I tried adding like below but getting error with syntax as below.
az network application-gateway waf-policy custom-rule update
--resource-group rp-licaltcs-aks-prod --policy-name waf-licaltcs-prod-...
CommunityBot
- 1
14
votes
1
answer
16k
views
AWS EC2 deny single ip address and allow all
I have a AWS EC2 instance and want deny access on port 80 for a single ip address (a bad bot).
AWS console it seem support only "allow" rules.
How deny a single ip address?
0
votes
1
answer
185
views
MSSQL reportserver behind web application firewall
Good Morning everyone!
First, please just point me in direction, where can I look into documentation.
I should get a consultant, but as a DBA, I want to solve this issue by myself.
Issue:
Management ...
- 1
0
votes
1
answer
188
views
Azure Firewall routing to Backend
We are trying to host multiple sites at the backend of Azure Firewall, however we have about 30 different sites and each with their own test\dev and UAT site, which means 30 x 4 and 120 sites, each ...
- 9,294
2
votes
2
answers
3k
views
Use AWS WAF to block traffic to my lightsail instance
I have an AWS lightsail instance running wordpress. It is getting pounded with hits from Chinese IP addresses - and they keep changing IP's. I started making hundreds of iptables rules but am giving ...
- 1
1
vote
3
answers
260
views
Does it make sense to augment WAF (Web Application Firewall) with an IPS (Intrusion Prevention System)?
Following scenario:
Web application, only HTTP/S traffic
Firewall in place to only allow traffic on port 80/443 in
WAF is in place, set to deny malicious traffic
Question: Is there any added value ...
- 711
0
votes
0
answers
53
views
How does ClamAV secure its updates online?
Two questions, the second related to the first...
How does ClamAV secure its update virus definition operations from its online servers? I will assume (?) that it uses HTTPS for security, but a ...
- 145
0
votes
1
answer
43
views
Azure WAF: Using FrontDoors or AplicationGateway?
We need a WAF for our Webservice which we are developing at the moment and I'm not sure if we should use FrontDoors or an ApplicationGateway.
For the start, we plan to offer our service just for ...
- 39k
1
vote
0
answers
590
views
How to Implement Rate Limiting in Azure Web Application Firewall(WAF)?
I am looking to implement global rate limiting to Azure WAF. I have created custom rate limiting rules but they are IP based. I know Azure DDoS protection provides a certain coverage limit. But my ...
0
votes
2
answers
338
views
Putting WAF on a loadbalancer?
at the moment, our application servers are directly accessable on the internet, like the following picture shows.
With this in mind, it would be aful if a server crashes (hardware-failure) or stops ...
0
votes
2
answers
1k
views
How do I restrict a specific client, based on their host name, with ModSecurity SecRule?
I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work.
# Block AWS
SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
- 141
2
votes
0
answers
390
views
AWS WAF ACL Rule for cookie value
I was trying to make an acl rule in waf2 which allows only a regex matched cookie value, but only if the cookie exists.
sadly, this type of conditional rule aren't possible and I tried many ways and ...
- 141
0
votes
1
answer
1k
views
Azure Application Gateways - VMs from other Virtual Networks
Can I use VMs (backend pools) on different virtual networks to the application gateway?
When I try, the VM list is empty.
Thanks
- 71.3k
0
votes
0
answers
360
views
WAF(modsecurity) / Plesk IP Banned, is it Googlebot? Is it a false positive? Is it a malicious IP?
I was alerted by my Plesk server that an IP Address had been banned. Normally I don't check banned IPs, but this one happened to coincide with our site going down for 1 minute at the same time.
Banned ...
- 141
4
votes
2
answers
8k
views
How to exclude ModSecurity rules by hostname?
I'm using OWASP core rule set 3.2.0 set up with ModSecurity 3.0.4 and ModSecurity-nginx.
If I have a rule exclusion like this, in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf:
SecRule REQUEST_URI "@...
- 49.8k
2
votes
1
answer
2k
views
attackers bypass aws waf to go for ec2 instances directly
My Setup
I have Elastic Beanstalk application, with a public LoadBalancer and public IPs on EC2.
The application is behind CloudFront, which is protected with AWS WAF from different attacks I am ...
- 32.9k
2
votes
1
answer
301
views
'Hard-to-guess' custom header (or similar) to whitelist via a firewall
My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.
We thought of doing ...
- 25.5k
2
votes
1
answer
2k
views
Enabling WebSockets (SignalR) with a Barracuda WAF
I am currently tearing my hair out at work trying to resolve an issue with a web application that uses SignalR over WebSockets where traffic is directed through a Barracuda Web Application Firewall (...
- 1
1
vote
1
answer
1k
views
Azure Application Gateway uses FIPS 140-2 validated module
Does Azure Application Gateway uses FIPS 140-2 validated module for SSL/TLS offloading? Can we enable FIPS mode in Azure application gateway for TLS offloading?
7
votes
1
answer
5k
views
Is there a need for WAF in static website front with REST API?
I have two webistes
www.mysite.com. -->hosted on s3 , served via Cloudfront static single page App.
Then I have api.mysite.com , which the front end uses.
My company is using WAF solution from ...
- 206
2
votes
1
answer
4k
views
Possible to use Azure Application Gateway and Azure Firewall on AKS?
I have an AKS cluster running on Azure (managed Kubernetes). I'd like to put a WAF in front of it, using Azure Web Application Gateway. I think this is possible.
But I also want a firewall in front ...
- 628
0
votes
1
answer
1k
views
Securely allow inbound return from api calls
Is it secure to open inbound Firewall rule from source 0.0.0.0/0 to receive inbound return IPv4 traffic from the internet (I need this only for requests that are originated in the subnet)?
I am ...
- 707
0
votes
1
answer
2k
views
How do I decrease the sensitivity of the AWS WAF sql injection filters?
We have our application set up on Amazon Web Services behind an ALB (Application Load Balancer) with a AWS WAF (Web Application Firewall). The WAF includes a rule to block SQL injection attempts using ...
- 150
0
votes
1
answer
56
views
SNAPT WAF Implementation
I just got the responsibility of implementing and managing the WAF for our SNAPT install. I have the WAF enabled on the Admin page for testing right now. I finally got an error so I can learn what the ...
- 45
0
votes
2
answers
299
views
About an idea to parry DDoS attacks
Background: I'm building a web application using Amazon API Gateway, Amazon S3, AWS Lambda and so on.
Note: If you don't know about AWS, any pieces of advice would be highly appreciated.
Searching ...
- 7,136
1
vote
2
answers
2k
views
how to modificate modsecurity rule action for only one parameter?
I have a modsecurity with Core Rule Set.
And I have POST-request with 3 parameters:
Par1 = "base64-encoded XML "&
Par2 = "url" &
Par3 = "hash".
I want to modificate CRS rules to base64Decode ...
- 143
3
votes
2
answers
7k
views
Securing Apache Solr in production
I am setting up Apache Solr 4.1 that will be used to index data for a web app. Only the web app should have access to the Solr. Users and other clients will not talk directly to Solr.
What are some ...
- 3,561
0
votes
1
answer
392
views
Unable to access Node Server from external network
I have a VM with two public IPs. I have installed OpenStack controller node on the VM. I have access from the external network to Horizon and Keystone service running on apache2 web server on ports 80 ...
- 3,488
1
vote
0
answers
75
views
nginx naxsi error - could not build the wlr_url_hash
I am getting this error in an nginx server compiled in with naxsi
nginx: [emerg] could not build the wlr_url_hash, you should increase wlr_url_hash_bucket_size: 512
nginx: [emerg] $URL hashtable init ...
- 347
0
votes
2
answers
2k
views
Apache2 mod_security simple default deny rules for specific directory
How to configure the simplest useful default-deny rule set for mod_security?
I want to configure mod_security to allow only very specific queries to single directory:
In short: I use Apache as a ...
- 81
2
votes
1
answer
3k
views
node-waf nodejs failing
When trying to compile Gilt Hummingbird for NodeJS, I get this error, as node-waf is missing.
rm -rf build .lock-wscript bson.node
node-waf configure build
make[1]: node-waf: Command not found
make[1]...
CommunityBot
- 1
0
votes
1
answer
103
views
Web app architecture - firewall blocking
I'm currently working on a web app and seem to be having a few problems with the app being blocked by office firewalls of our test groups. My background is in design / front end so my knowledge of ...
- 164
11
votes
1
answer
402
views
applicure dotdefender ISAPI filter causing pdf issue
I have recently migrated a web server form Server 2008 R2 to Server 2012 R2
The dotdefender application firewall works fine except for one issue.
On large PDF ~15MB or more it take anywhere from 1 - ...
- 136
-1
votes
1
answer
110
views
What are the MOST Important Things to Configure on a WAF? Specifically Barracuda Web Application Firewall
I will be hosting a web application on a cloud provider. This will be protected behind a WAF specifically Barracuda's Web Application Firewall Vx.
I do not have too much experience with WAF security....
- 1
0
votes
1
answer
329
views
Barracuda Web Application Firewall WAF - HTTP - Barracuda Does Not Filter Links Clicked on Page
I am trying to figure this out.
Basically the virtual IP 192.168.1.110 will filter port 80 to the real ip address 192.168.20.110.
I can confirm this in the logs.
When I click any link on the page (...
- 147
1
vote
2
answers
718
views
What web application firewall do you use? What should I use? [closed]
What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
-4
votes
1
answer
1k
views
Restrict Access from certain machines to my Web Application in LAN [closed]
I am trying to deploy a Local Network web application, which should not necessitate a client login.
The requirement is to block certain machines, (not users, just a few computers, the application ...
- 248k
1
vote
1
answer
2k
views
What is the difference between a SPI Firewall and an Application Layer Firewall?
What is the difference between a SPI Firewall and an Application Layer Firewall? In what circumstances would I prefer one over the other?
- 146
1
vote
2
answers
325
views
What tech. is required to build a firewall that dynamically opens ports after users authenticate through a web form against Active Directory?
I need to expose via Internet an insecure internal web app that can't be modified to be made intrinsically more secure. The most common solution for this problem is to access the web app through VPN. ...
- 28k
0
votes
1
answer
185
views
Spoof IPP response in firewall?
How I do to spoof a IPP "Unauthorized" response?
Have read the IPP specification documents but cannot find exactly how a IPP response should look like.
Any examples?
Basically, I have a IPP printer ...
0
votes
1
answer
251
views
HTTP-CLASS-Redirecting traffic-F5
Can we redirect https traffic to a particular real server using http-class in F5? i.e whether http-class works with both http and https traffic.?
- 39
2
votes
1
answer
239
views
Is there any application/firewall to detect content scrapers? [closed]
We are noticing that a significant amount of web traffic is from content scrapers (determined due to their crawling pattern). They are useless visitors to us but consume a lot of our resources (...
- 93
0
votes
1
answer
1k
views
F5 - URL redirect without irule
I have a main domain - url which is getting load-balanced through VIP between 2 Real Servers in F5 and I want a sub-domain of the main url not to be loadbalanced but to be pointed to a single real ...
- 19.5k
4
votes
1
answer
757
views
Examples where an AWS Security Group is not sufficient as a firewall?
Currently I am using only an AWS security group for one of my EC2 instances but have given some thought to adding a firewall to that stack as well. I'd be looking at using either iptables, or ...
- 137
0
votes
1
answer
714
views
SonicWALL SRA blocks load test as a DoS attack
I am evaluating the Web Application Firewall (WAF) service on a SonicWALL SRA virtual appliance. When I try to load test the protected website, SonicWALL blocks my requests with this error: "Reset ...
- 11
2
votes
0
answers
506
views
Barracuda 660 WAF SNMP - Barracuda-BWS::totalAttacks
I've come across a little problem with retrieving stats via SNMP from a Barracuda Web Application Firewall 660.
According to both the documentation (page 211), and the MIB defination, doing an SNMP ...
- 6,105
1
vote
0
answers
646
views
ActiveSync on iOS 4.2 no longer supports cookies?
We have a in-house developed WAF protecting our OWA (activesync) webserver, and part of its function requires long-lived Cookies on the "browsers". We're trying to get it to support iPhones via the "...
- 101k
2
votes
1
answer
318
views
What is the funniest firewall rule set? [closed]
What is the finniest firewall rule set that you know of? It doesn't necessarily have to stop attacks, you could just be having fun with the attacker. Any type of firewall will do, Packet Filter (...
- 9,105