I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS.
I would prefer using a cloud based WAF (e.g. CloudFlare or Incapsula). However I have some concerns if it would comply with PCI.
The setup is as follow:
Client ---> WAF ---> Origin Server
The origin server (our web server) can check the source IP address to protect the server. However the source IP address can be spoofed and hence an attacker can bypass the WAF.
As per response Is it possible to pass TCP handshake with spoofed IP address? a spoofing of layer 7 (which the WAF should protect) is theoretically possible. In practice it does not seem to be a feasible attack.
Is a cloud based WAF PCI compliant or not?
EDIT: To this specific question I found out that CloudFlare provides client certificate authentication. This was added in the last few days: https://blog.cloudflare.com/protecting-the-origin-with-tls-authenticated-origin-pulls/ However other questions remains unanswered.