Hello,
I am getting some unexpected and unwanted requests (trying to find exploits) that are handled by one of the WAF Rules:
Here's the WAF Rule that is being it with this traffic:
Here's how it looks in the Event Viewer:
How can I change the WAF rule (or through another rule) so if the traffic doesn't match the published paths (below), it gets dropped (instead of returning an HTTP 403)?
Thanks!
Thank you all. I think I'll still enable the Geo-Blocking. It bothers me to see requests from many parts of the world being answered as HTTP 403. All of these are not legitimate attempts (in the last 5 days):
Just one more thing: If you activate Country Blocking in the WAF rule, you'll still receive a 403 response. If your aim is to genuinely block or drop traffic from specific countries, then consider using BlackHole NAT—a NAT rule that directs to a non-existent host. For more details, you might want to check this link:
As a potential target, I suggest selecting a host within the 192.0.2.0/24 range, as outlined in RFC 5735. It's worth noting, though, that the NAT rule is not connected to your WAF Rule and, as such, cannot be employed to filter by country exclusively for certain domains or URLs. Instead, it will apply the country filter to all traffic that matches the NAT rule's criteria.
