Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

our ip addresses got blocked by AWS WAF and need to be unblocked

0

I work at an ISP and, obviously, we use our own IP addresses both for our customers and for our own internet access. We use AWS for some things.

We also provide some hosting services for a small number of websites (seriously, a small number) but the majority of our business is residential and business office internet service. Somehow AWS has decided all of our IP addresses are part of a hosting provider and they are being blocked by a lot of applications that use the AWS WAF reputation IP group HostingProviderIPList. We have heard complaints from a number of customers that they cant use certain websites or apps because of this issue. The number of IPs in use for hosting services is probably about 8 - 10% of our total IP space. The rest are all for various internet access services.

I can't find any way to have them removed from the list or to modify our use or administration of the IPs to have them removed automatically. AWS general support has not yet replied to our efforts to contact them. Any ideas?

Topics
Management & GovernanceNetworking & Content DeliverySecurity, Identity, & ComplianceAWS Well-Architected Framework
Tags
Amazon VPCAWS WAFAWS Account ManagementNetworking & Content DeliverySecurity
Language
English

asked a year ago679 views

1 Answer
0

I’ve run into this exact problem before it’s frustrating because AWS WAF’s HostingProviderIPList is entirely automated, and there’s no self-service removal. It’s driven by AWS + third-party threat intel, so if your ASN/CIDRs look like “hosting,” everything in that range gets flagged.

What’s worked for me in the past:

  • Open a WAF & Shield support ticket and specifically ask for escalation to the Managed Rules team. General support can’t fix this escalation is key. In the ticket, give them:
    • The exact CIDRs affected
    • Proof from ARIN/RIPE/APNIC that these are ISP/residential ranges
    • The percentage of your space used for actual hosting (helps your case)
  • If you can, split your hosting IPs from your access IPs into separate ranges. It makes AWS (and other reputation providers) way more willing to delist the clean ranges.

While you wait, you can temporarily move customer NAT traffic to a clean subnet or use a different upstream for those IPs.

Here’s AWS’s own doc on the list: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-reputation.html

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content