WAFバージョン2のWebACLおよびルールが正常に動作していません WAF version2 webACL and rule not working properly

Question

お世話になっております。

申し訳ありません。

サマリ

IP set で特定の/32のIP何個かを指定している

WAF v2 webACLあり

Rules
webACLにIP setのIPをブロックするレギュラールールあり

```
{
  "Name": "blockRule",
  "Priority": 0,
  "Statement": {
    "IPSetReferenceStatement": {
      "ARN": "arn:.............."
    }
  },
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "blockRule"
  }
}
```

Associated AWS resources　
webACLにリソース割り当て済み。ALB。

WebACLの完全なログ記録が有効になっています。

ですが

IP set で特定しているIPから通信きているのにブロックされていません。
別のシステムのログで確認できています。

webACLのSampled requestsにブロック用のルールのログありません。

問題は何でしょうか？
ここりあたりありますでしょうか。

ありがとうございます。

よろしくお願い致します。

Hi support,

Appreciate your help.

Apologies for the inconvenience.
Summary

Couple of specifics /32 IP is specified in an IP set.
    A WAF v2 webACL is in place.

Rules:
There is a regular rule in the webACL to block the IP specified in the IP set:

{
  "Name": "blockRule",
  "Priority": 0,
  "Statement": {
    "IPSetReferenceStatement": {
      "ARN": "arn:.............."
    }
  },
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "blockRule"
  }
}

Associated AWS Resources:
The webACL is assigned to a resource (ALB).

full logging for the WebACL  is enable

Issue
Despite traffic originating from the IP specified in the IP set, it is not being blocked. Logs from another system confirm the traffic.

There are no logs in webACLs "Sampled Requests" section for the rule.

Question
What could be the problem?

Do you have any ideas or suggestions?

Thank you for your assistance.

Riku_Kobayashi · Answer

該当のIPから接続が来ているというのをAWS WAFのログから確認できますか？(Athenaとかでクエリかけてみてください)  
https://docs.aws.amazon.com/ja_jp/waf/latest/developerguide/logging-management-enable.html  
https://docs.aws.amazon.com/ja_jp/athena/latest/ug/waf-logs.html

設定jsonを見る限りは問題なさそうに見えるのですが、念のため以下のブログと同じ設定になっているか確認してみてください。  
https://iret.media/93123

re:Post Agent · Answer

Based on the information provided, there are several potential reasons why your WAF v2 WebACL and rule might not be working as expected:

1. Rule Priority: The rule you've shown has a priority of 0, which means it should be evaluated first. However, if there are other rules with the same or lower priority that are allowing the traffic, they might be overriding this rule.

2. Default Action: If the WebACL's default action is set to "Allow," and for some reason the rule isn't matching the traffic, the requests would be allowed through.

3. IP Set Configuration: Ensure that the IP addresses in your IP set are correctly formatted and include the proper CIDR notation (/32 for single IPs).

4. Resource Association: Confirm that the WebACL is correctly associated with your ALB. Sometimes, the association might not be active or might have been removed.

5. Rule Action: The rule is set to "Block," which is correct for your intention. However, make sure there isn't a scope-down statement or other condition that might be preventing the rule from matching.

6. Logging and Metrics: Since you mentioned there are no logs in the Sampled Requests, check if logging is properly enabled for your WebACL. Also, verify that CloudWatch metrics are enabled for this rule.

7. ALB Configuration: Ensure that your ALB is configured to forward the correct client IP address to WAF. If you're using an intermediate proxy or CDN, you might need to configure the ALB to use the X-Forwarded-For header.

8. Traffic Source: Double-check that the traffic you're seeing in your other system's logs is actually reaching the ALB and not bypassing it somehow.

To troubleshoot:
- Review all rules in your WebACL and their priorities.
- Check the WebACL's default action.
- Verify the IP set configuration.
- Confirm the WebACL-ALB association.
- Enable full logging for the WebACL if not already done.
- Check CloudWatch metrics for the specific rule and WebACL.
- Review your ALB configuration for proper client IP forwarding.

If the issue persists after checking these points, you may need to capture and analyze network traffic or engage AWS support for more in-depth troubleshooting.  
**Sources**  
[WebACL - AWS WAFV2](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_WebACL.html)  
[WebACL - AWS WAFV2](https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_WebACL.html)  
[Creating and configuring a Web Access Control List (Web ACL) - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl.html)  
[UpdateWebACL - AWS WAFV2](https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateWebACL.html)

WAFバージョン2のWebACLおよびルールが正常に動作していません WAF version2 webACL and rule not working properly

関連するコンテンツ