Access Control for WAF in OCI aka Oracle Cloud Infrastructure

 In my last post https://samappsdba.blogspot.com/2023/01/web-application-firewall-as-reverse-proxy-server-oci.html, we have seen how we can setup the WAF in OCI. In this post, we will see how we can setup access control for WAF in OCI. 

What are access Controls:-Describes the conditions for an access rule used with a WAF policy.As a WAF administrator, you can define explicit actions for requests that meet various conditions. Conditions use various operations. A rule action can be set to allow, check, and return HTTP response for all matched requests.

In this post, i have tried to simulate a scenario, wherein if the requests are coming from Region India, it will not allow it.

Publish the changes. Now if I try to login

In the log, I can see that it has been blocked

Now, for the same region, how to allow a single IP address.

Conditions will be:-

Save the changes and publish it. Publishing the changes takes around 10 mins of time.

There it is

 

I can access the site now

I hope this post will help someone. Till then keep learning cloud.

Reference:-https://docs.oracle.com/en-us/iaas/Content/WAF/AccessControl/access_control_management.htm

Web Application Firewall(waf) as reverse proxy in Oracle Cloud (OCI)

 Oracle Cloud Infrastructure Web Application Firewall is a regional-based and edge enforcement service that is attached to an enforcement point, such as a load balancer or a web application domain name. WAF protects applications from malicious and unwanted internet traffic. WAF can protect any internet facing endpoint, providing consistent rule enforcement across a customer's applications. In this post, WAF works as a reverse proxy between the client and your website server. The real IP addresses of your website server are hidden from the visitors, and only the IP addresses of WAF are visible to them. The IP address of the web server is already mapped with DNS mapping.

Create WAF Policy

WAF Origin is basically the host or IP address of the public internet facing application that is being protected by the application. 

This takes time. Once it is created successfully, you will get the below screen.

Now test your application. Reference:-https://docs.oracle.com/en-us/iaas/Content/WAF/Concepts/gettingstarted.htm

Now, go to the OCI DNS Service and create a CNAME.

Publish the changes.

Next, modify the security lists of the webserver to recieve the requests from WAF. At this moment, we would need the IPV4 address of the WAF. If you scroll above, when we tested the application, we had recieved one IPV4 address. If I check the IP address for WAF server, it gives me the CIDR value with reference 192.29.50.64 and thus i used 192.29.0.0/16.

In the browser now, test it

We can verify the logs from WAF

Response code is 200.

I hope this post will be helpful for someone. In the next post, we will see how we can use Access Control in WAF for OCI. Till then, happy learning cloud.

Reference:-https://docs.oracle.com/en-us/iaas/Content/WAF/Concepts/overview.htm#:~:text=Oracle%20Cloud%20Infrastructure%20Web%20Application%20Firewall%20is%20a%20regional%2Dbased,malicious%20and%20unwanted%20internet%20traffic.