AWS WAF Rate-Based Rule - How to permanently block offending IP addresses?

Question

Hi all,

I would like to hear your approaches when applying a rate-based rule via AWS WAF.

What are the best ways to permanently block IP addresses that trigger the RBR? I would also like to send notification to our internal team that:
1. The rule has been triggered
2. List the IP (or IPs) that have been blocked

Thanks!

Oleksii Bebych · Answer

look at this blog
https://aws.amazon.com/blogs/networking-and-content-delivery/configure-block-duration-for-ips-rate-limited-by-aws-waf/

Frank · Answer

Hi Adrian,
If your requirement is block specific ip permanently, create an ip set steps: [Here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-ip-set-creating.html) and create a new Web ACL/ Rules / "Add my own rules and rule groups” select the IP Set, Source IP Address, Action->Block and save, steps: [Here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-ip-set-creating.html).

AWS WAF Rate-Based Rule - How to permanently block offending IP addresses?

Añade tu respuesta

Contenido relevante