AWS WAF efficient rule for allowing specific IPs and Countries for specific URLs

0
  1. I want to allow abc.example.com/* in a specific country xyz what will be best rule for it ?
  2. what will be rule in case to allow only specific ips to acces abc.example.com?
asked 6 months ago46 views
2 Answers
0

You could accomplish this via rules in a Web ACL in AWS WAF. A geomatching rule like this:

Action": {
    "Block": {}
    "Statement": {
       "NotStatement": {
          "Statement": {
"GeoMatchStatement": {
          "CountryCodes": [
            "CA"
                      ]
        }

in your Web ACL would block all traffic except traffic originating in Canada.

You can also restrict access to an approved group of IP addresses by creating a list of addresses in WAF, and then creating a rule in the Web ACL to allow only those IP addresses.

profile picture
jwesley
answered 6 months ago
  • Good , but I want to know e.g. I have multiple URLs i.e. abc.example.ccom, xyz.example.com, ghi.example1.com, example2.com etc. and I want to block on specific URL e.g. abc.example.com ....out of multiple URLs how can I do for a specific URL

  • Good , but I want to know e.g. I have multiple URLs i.e. abc.example.ccom, xyz.example.com, ghi.example1.com, example2.com etc. and I want to block on specific URL e.g. abc.example.com ....out of multiple URLs how can I do for a specific URL

0

You need to write a string match or regex match rule that looks at host header field AND put another condition to look for the country you want to allow. You may want to set web ACL default action to block as well.

Might want to look at this as well https://www.youtube.com/watch?v=ll-uvVgQ3Jg (skip to 50%)

{
  "Name": "test-rule",
  "Priority": 0,
  "Action": {
    "Allow": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "test-rule"
  },
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "FieldToMatch": {
              "SingleHeader": {
                "Name": "Host"
              }
            },
            "PositionalConstraint": "STARTS_WITH",
            "SearchString": "abc.example.com",
            "TextTransformations": [
              {
                "Type": "LOWERCASE",
                "Priority": 0
              }
            ]
          }
        },
        {
          "GeoMatchStatement": {
            "CountryCodes": [
              "US"
            ]
          }
        }
      ]
    }
  }
}
answered 6 months ago
  • Thanks @Kumo-Hiyori for a reply, I try the above rule with country statement and without country statement, but it doesn't work.

    I don't know what's the reason behind But Then I try single statement rule looking for single header host starts with abc.example.com and block all traffic but it still allows , I don't know why ,

    Any solution?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions