Mod Security, HTTP:BL different configuration for mobile phone browsers?

user_19423758 0
Viewed 31

I tested the rule on Firefox within Ubuntu VM and it worked as it gave me a forbidden error code page. When I tested it on my phone browser, it does not work as it just shows the index page with no errors. Is there a different configuration I needed to do for it or it just does not work on a mobile phone browser?

The URL I used is, "HTTP://vhost1.group21.com/?ID=103.50.84.114".

SecHttpBlKey (key here)
SecAction "id:900500,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:tx.block_search_ip=0,\
  setvar:tx.block_suspicious_ip=1,\
  setvar:tx.block_harvester_ip=1,\
  setvar:tx.block_spammer_ip=1"
mod-security webserver linux apache
1 Answers

This should not be a thing. This is about IP connections and not about the origin of the request.

The only difference I see is the IP address. So the VM and the mobile device have different IPs and the RBL lookup gives a different result for the two.

In order to debug this, I suggest you put all the rules in the 910 rule file to "log" (now "nolog") and then check the error log and compare when it blocks and when it does not. This should allow you to isolate the misbehaviour.

user_64032090
Related