2

I have an apache server with ModSecurity. I need to block all IPs except for a few ones.

The list of IPs is like this:

194.83.128.0/21
191.143.32.0/19
145.126.72.0/21
101.28.248.0/22
40.64.64.0/22
180.11.124.0/22
190.230.64.0/18
109.154.0.0/16
42.60.0.0/16
43.223.0.0/16
2a03:e980::/29

Right now I applied this rule:

SecRule REMOTE_ADDR "@ipMatch 194.83.128.0/21,191.145.32.0/19,145.126.72.0/21,101.28.248.0/22,40.64.64.0/22,180.11.124.0/22,190.230.64.0/18,109.154.0.0/16,42.60.0.0/16,43.223.0.0/16,2a03:e980::/29" "id:162"

But the rule above seems to be doing a whitelist rather than blocking all IPs except for the ones defined in the rule.

I'm not sure how to achieve blocking all IPs except the ones on my list. Most of the documentation I have found is related to blocking or adding IPs to a deny list, when some action happens, like constantly accessing 404 pages.

Is there a way to block by default all the IPs, except the ones defined in my list?

6
  • isn't "whitelist" == "blocking all IPs except for the ones defined in the rule" ?
    – elsadek
    Commented Apr 1, 2022 at 18:34
  • Applying that rule still allow me to connect. I mean doing something like telnet my.ip 443 is allowing the connection.
    – Jacobo
    Commented Apr 1, 2022 at 18:41
  • 2
    @Jacobo: "telnet my.ip 443 is allowing the connection." - If you want to have already the TCP connection blocked then ModSecurity is not the right tool. It blocks at the application level, which means that the TCP and TLS/HTTPS connection establishment is not affected by ModSecurity. Commented Apr 1, 2022 at 19:02
  • 1
    @Jacobo: a classic firewall like iptables or similar, depending on the OS. Commented Apr 1, 2022 at 19:40
  • 1
    Is more effective block the ips at the operating system level, with iptables if you are in linux for example.
    – camp0
    Commented Apr 2, 2022 at 15:20

2 Answers 2

3

With Apache, you would not be using a WAF like ModSecurity for simple access control, but mod_authz_core's Require Directive in the directory or .htaccess context:

<Directory "/path/to/protect">
    Require ip 194.83.128.0/21
    Require ip 191.143.32.0/19
    Require ip 145.126.72.0/21
    Require ip 101.28.248.0/22
    Require ip 40.64.64.0/22
    Require ip 180.11.124.0/22
    Require ip 190.230.64.0/18
    Require ip 109.154.0.0/16
    Require ip 42.60.0.0/16
    Require ip 43.223.0.0/16
    Require ip 2a03:e980::/29
</Directory>

This blocks all the other IP addresses at the application layer: the client will get a 403 Forbidden HTTP error. Therefore, you cannot test this using Telnet or Netcat, but with an actual HTTP(S) capable browser (e.g. Curl).

2

It is possible:

You can insert your IPs in a file (here /my/path/file.txt) for easy handling.

So, add the rule:

SecRule REMOTE_ADDR "!@ipMatchF /my/path/file.txt" "id:162, phase:1, pass, ..."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .