AWS - Firewall Manager - WAF Rules How to block requests from IP address (No Host name)?

user_1179459 0
Viewed 679

I am using AWS Firewall manager for my website, with Web-ACL to deny DOS attacks and Hacking requests.

However, I still get below requests coming through to my webserver, from Firewall Configuration (Missing my waf-rules) In below example lets assume that 3.6.8.8 is my web server IP address.

3.6.8.8/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application
3.6.8.8/actuator/health
3.6.8.8/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

In real legitimate case, none of my acceptable requests should not be calling via direct IP like 3.6.8.8, for example, all my website requests are like below

https://*.example.com/*

I wonder how can I block the above requests that are pretending to be originating from my Ip address 3.6.8.8 with WAF rule?

firewall amazon-web-services security
2 Answers

You can configure your rule statement in your WAF web ACL to Inspect the Header and set your Header field name to Host and finally specify a Match Type to a regex pattern.

With this configuration you can create a regex that checks if the Host is an IP address. If it is, block the request.

Hope this helped!

Admin1

we have the exact same problem. Even to the point where the URLs that are being probed are Exchange related (just like one of your examples above).

The short answer is that there is NO AWS Firewall rule that will block these requests because by using your Web Server's IP address in the URL, they are circumnavigating the AWS firewall and talking directly with your web server.

*.example.com will resolve to the AWS firewall device but 3.6.8.8 goes directly to your web server.

What we have seen over the years is that bad actors compile lists of sites to probe and store both the host name AND the IP address so they can get around firewalls once they are put in place. (usually at a later date, after the site is up and running).

So, the only real solution is to turn off HTTP/HTTPS access to your webserver from the outside world and only allow traffic from the AWS Load Balancer. This can be done in the Security Group your EC2 Instance is tied to.

I hope that helps!

user_176299740
Related