WAF Rules Allowing Unexpected Requests

Thanks Raphael. I understand. 

If I enable country blocking on this rule, will the traffic coming from a blocked country be rejected or dropped? 

Is there anything else (from the security standpoint) that I could put in place to better handle this (outside any complex automation as you described)?

Just want to have peace of mind that I am locking this down as much as I possibly can. 

Bumping this up..

Is there anything else (from the security standpoint) that I could put in place to better handle this (outside any complex automation as you described)? Just want to have peace of mind that I am locking this down as much as I possibly can. 

Thanks!

Essentially no - You could add GEO IP blocking, if you think, this will increase something, but nowadays attacks are not based on IP geo locations. 

I'm afraid, there isn't much more you can do without increasing complexity. If you got some $$$ then another / additional vendor product might help - but in the end, this will increase complexity as well...

Thank you all. I think I'll still enable the Geo-Blocking. It bothers me to see requests from many parts of the world being answered as HTTP 403. All of these are not legitimate attempts (in the last 5 days):

Just one more thing: If you activate Country Blocking in the WAF rule, you'll still receive a 403 response. If your aim is to genuinely block or drop traffic from specific countries, then consider using BlackHole NAT—a NAT rule that directs to a non-existent host. For more details, you might want to check this link: 

https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/FirewallRulesBlackHoleDNATRuleCreate/index.html

As a potential target, I suggest selecting a host within the 192.0.2.0/24 range, as outlined in RFC 5735. It's worth noting, though, that the NAT rule is not connected to your WAF Rule and, as such, cannot be employed to filter by country exclusively for certain domains or URLs. Instead, it will apply the country filter to all traffic that matches the NAT rule's criteria.

Just one more thing: If you activate Country Blocking in the WAF rule, you'll still receive a 403 response. If your aim is to genuinely block or drop traffic from specific countries, then consider using BlackHole NAT—a NAT rule that directs to a non-existent host. For more details, you might want to check this link: 

https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/FirewallRulesBlackHoleDNATRuleCreate/index.html

As a potential target, I suggest selecting a host within the 192.0.2.0/24 range, as outlined in RFC 5735. It's worth noting, though, that the NAT rule is not connected to your WAF Rule and, as such, cannot be employed to filter by country exclusively for certain domains or URLs. Instead, it will apply the country filter to all traffic that matches the NAT rule's criteria.