Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 7 replies
  • Subscribers 41 subscribers
  • Views 3227 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF Rules Allowing Unexpected Requests

cm00001

Hello,

I am getting some unexpected and unwanted requests (trying to find exploits) that are handled by one of the WAF Rules:



Here's the WAF Rule that is being it with this traffic:




Here's how it looks in the Event Viewer:

How can I change the WAF rule (or through another rule) so if the traffic doesn't match the published paths (below), it gets dropped (instead of returning an HTTP 403)?

Thanks!



This thread was automatically locked due to age.
  • +1
    I don't think this is possible. Although the Sophos GUI allows you to configure both in the same place (WAF and Packet Filter), they are distinct entities. A packet should have already traversed the packet filter (where packet dropping occurs) before reaching the WAF module. An HTTP 403 Forbidden response is essentially the packet filter's REJECT action equivalent. For true packet dropping based on WAF actions, Sophos would need to implement a system that can control the packet filter based on WAF outcomes, similar to how Fail2Ban operates.
    If this functionality is essential, one potential workaround could be analyzing the WAF logs and dynamically generating firewall rules through the API. This would of course involve some external systems to automate the process. Of course this means, that the first (few) requests would have to hit the WAF anyway. 
  • 0

    Thanks Raphael. I understand. 

    If I enable country blocking on this rule, will the traffic coming from a blocked country be rejected or dropped? 

    Is there anything else (from the security standpoint) that I could put in place to better handle this (outside any complex automation as you described)?

    Just want to have peace of mind that I am locking this down as much as I possibly can. 

  • 0 in reply to cm00001

    Bumping this up..

    Is there anything else (from the security standpoint) that I could put in place to better handle this (outside any complex automation as you described)? Just want to have peace of mind that I am locking this down as much as I possibly can. 

    Thanks!

  • 0 in reply to cm00001

    Essentially no - You could add GEO IP blocking, if you think, this will increase something, but nowadays attacks are not based on IP geo locations. 

    __________________________________________________________________________________________________________________

  • 0 in reply to cm00001

    I'm afraid, there isn't much more you can do without increasing complexity. If you got some $$$ then another / additional vendor product might help - but in the end, this will increase complexity as well...

  • 0 in reply to cm00001

    Thank you all. I think I'll still enable the Geo-Blocking. It bothers me to see requests from many parts of the world being answered as HTTP 403. All of these are not legitimate attempts (in the last 5 days):

  • 0 in reply to cm00001

    Just one more thing: If you activate Country Blocking in the WAF rule, you'll still receive a 403 response. If your aim is to genuinely block or drop traffic from specific countries, then consider using BlackHole NAT—a NAT rule that directs to a non-existent host. For more details, you might want to check this link: 

    https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/FirewallRulesBlackHoleDNATRuleCreate/index.html

    As a potential target, I suggest selecting a host within the 192.0.2.0/24 range, as outlined in RFC 5735. It's worth noting, though, that the NAT rule is not connected to your WAF Rule and, as such, cannot be employed to filter by country exclusively for certain domains or URLs. Instead, it will apply the country filter to all traffic that matches the NAT rule's criteria.

    Blackhole NAT

Unfiltered HTML