A web application firewall (WAF) is a crucial tool that helps keep its users’ network safe from attackers. It resides in between the webpage (or API) and the outside world, meaning that it is responsible for checking the incoming traffic and preventing any attacks from reaching its servers. One of the main functions of WAFs is IP control, or, in other words, their ability to restrict access according to the origin of the traffic and block requests from specific IPs.
Terminology note: Most vendors no longer use the terms “whitelist” and “blacklist”. Instead, they prefer more inclusive and precise terminology.
Furthermore, in this guide, the “allowlist” and “blocklist” terminology will be used, keeping the old terminologies just for reference.
This detailed guide mentions what these lists do, when to use them, and how to set them up appropriately regardless of the WAF solution one employs (AWS WAF, Cloudflare, Azure WAF, etc.). Although each dashboard may differ in the specific steps, the fundamental principles behind using the lists remain applicable irrespective of your WAF selection.
What Is an Allow List (Whitelist)?
An allow list refers to a list of the IP addresses that are trusted. Web traffic addresses from these:
- Does not get inspected by WAF, or
- Gets allowed regardless of other security rules contravening it.
Common use cases
- The office’s or VPN’s IP address, which allows employees to avoid being stopped by the stringent regulations.
- Third-party services relied on, such as payment processors or partners’ APIs.
- Internal health check or load balancer addresses.
- Search engine crawlers you wish to reach (for instance, Googlebot).
What Is a Block List (Blacklist)?
What is Blacklisting & IP Address Reputation?
A block list consists of individuals or groups of IP addresses that are deliberately denied access. Thus, requests coming from these specific addresses would not be processed and rejected before ever getting to the target (typically with an HTTP 403 (Forbidden) response).
Common use cases
- Disabling access from a specific IP address that is responsible for attacking or scraping your site.
- Disabling access from already-known malicious IP address groups.
- Disabling access from foreign IP addresses belonging to countries where you do not do business.
- Temporarily blocking access to an IP address that has been involved in cyber activities.
How IP Rules Are Evaluated?
The most important thing for beginners to know is the concept of rule order and priority. It is the main cause for misconfiguration. The most common approach used by WAFs is as follows:
- Firstly, block (deny) rules are assessed. If matching an IP address, no further checks will be needed.
- Then, allowed rules are evaluated. If the rule is satisfied, the traffic is directly allowed.
- Lastly, default rules are applied to traffic that has not met with any previous conditions.
It is essential to verify how rules are organized on a specific platform, as it is not presence alone but also the priority of the rules that eventually defines the result. If the priority of a block rule is lower than the priority of a conflicting allow rule, the allow rule takes precedence. In case you are unsure, test with a “count only” or “monitor” mode before implementation.
How to Whitelist and Blacklist IP Addresses in WAF? Step-by-Step Guide
Even though dashboards differ, the workflow is almost the same for all WAFs:
Step 1: Define an IP address or range
- Choose a sole IP address for the specific device (e.g., 203.0.113.42).
- Or use CIDR notation for a range (e.g., 203.0.113.0/24 defines a range of 256 devices).
- In case you are allow-listing a third-party service, be sure to obtain the official range of IPs—there should be no guessing or using outdated blogs, as the IP ranges may change.
Step 2: Create an IP set / IP list
- Most WAFs require you to create a reusable “IP set” or “IP list” object with one or several devices instead of using IPs directly in rules.
Step 3: Develop a rule that utilizes the IP set
- In the case of an allowlist, a rule must be created with the action Deny having the following condition: “source IP is in [IP set].”
- In the case of a blocklist, a rule must be created with the action Allow for the following condition: “The source IP is in [IP set].”
Step 4: Define the priority of the rule
- Put the new rule in the appropriate position of your chain of rules. Typically, you should place block rules for known bad IPs near the beginning of the chain.
- Allowable rules regarding trustworthy infrastructures are situated high in the chain so that the decisive rules below them do not block them.
Step 5: Test and evaluate the rule before applying it
- Use the “monitor” method at first when applying the rule.
- When testing, track and evaluate the logs to be sure that the rule works well and matches the needed traffic.
Step 6: Change to working method
- When sure that the rule operates correctly, use it as a working method.
Step 7: Document and Review
- Keep a record of the reasons why every IP address has been included. You can sort those with proper tags (such as ticket details, requestor’s identity, and date when action was taken).
- Remind yourself to review the allow/block lists every quarter, since keeping outdated entry lists can lead to security problems in the long run.
