{"id":8295,"date":"2021-02-24T15:41:26","date_gmt":"2021-02-24T15:41:26","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/configuring-a-per-site-waf-policy-with-ip-address-restriction-rules-part-three\/"},"modified":"2026-11-03T19:29:32","modified_gmt":"2026-11-03T19:29:32","slug":"configuring-a-per-site-waf-policy-with-ip-address-restriction-rules-part-three","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/configuring-a-per-site-waf-policy-with-ip-address-restriction-rules-part-three\/","title":{"rendered":"Configuring a per-site WAF policy with IP address restriction rules: Part three"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

As I mentioned in the introduction in Part one<\/a>, the end goal is to demonstrate how to control inbound access based on IP address restrictions to one of my two websites running on the Windows\u00ae virtual machine (VM).
\nPart two of the series<\/a> laid the foundation with the the Application Gateway configuration. Now, in this final post of the series, I walk through the Web Application Firewall (WAF) policy creation and test the custom rule. I will restrict access to  site2.hiteshvadgama.co.uk<\/strong>.  <\/p>\n

 WAF policy configuration<\/strong><\/p>\n

The following steps show how to create a per-site WAF policy with an IP-based access control rule and assign it to the Application Gateway and Site2_Listener<\/strong>, which we know from the earlier HTTP Settings section in Part two<\/a>
\nis the listener that corresponds to site2.hiteshvadgama.co.uk<\/strong>.<\/p>\n

1. Search for WAF<\/em> in the marketplace, select the Web Application Firewall (WAF) by Microsoft<\/strong> service, and click Create<\/strong>.<\/p>\n

2. On the Basics<\/strong> tab, assign the policy to the Regional WAF (Application Gateway) <\/strong>and fill in the rest of the basic details. Make sure the location<\/strong> you choose is the same location as the Application Gateway WAF resource. For now, I will disable<\/strong> the Policy state<\/strong>.<\/p>\n

\"WAF<\/p>\n

3. On the Policy settings<\/strong> tab, select Prevention<\/strong> mode. I didn\u2019t make any changes to the default settings in the  Exclusions<\/strong> or Global Parameters<\/strong> section. You can make changes if you want to exclude specific parts of an incoming request or modify the request body parameters. <\/p>\n

\"waf<\/p>\n

4. On the Managed Rules<\/strong> tab, I kept the default OWASP 3.0 rule set<\/strong>. Depending on your requirements, you might want to choose a different rule set or modify the ruleset if certain rules are, for example, causing false positives and blocking legitimate traffic.<\/p>\n

\"waf<\/p>\n

5. On the Custom rules<\/strong> tab, I selected Add custom rule<\/strong>. <\/p>\n

\n6. I gave the rule a name<\/strong> and a priority<\/strong>. As a best practice, assign priority in increments of five to make it easier to change the order of rules in the future.<\/p>\n

7. For the IF<\/strong> statement under Conditions<\/strong>, I selected IP address<\/strong> as the Match Type<\/strong> and Does contain<\/strong> as the operation. For my test, I want the rule to block access if the IP address matches my local machine, so I did an IP lookup of the machine and added it under IP address or range<\/strong>. <\/p>\n

8. For the THEN<\/strong> statement, I selected Deny traffic<\/strong> and clicked Add<\/strong> to save the custom rule.<\/p>\n

\"waf<\/p>\n

9. On the Associations<\/strong> tab, I clicked on Add association<\/strong> and selected HTTP Listener<\/strong>. <\/p>\n

10. Because I have only one Application Gateway, it was already pre-populated.<\/p>\n

11. In the Listeners<\/strong> menu, I selected Site2_Listener<\/strong>. This is the listener associated with site2.hiteshvadgama.co.uk<\/strong>, which is the site I want to restrict access to. <\/p>\n

\"waf<\/p>\n

12. Click Review + create<\/strong> and Create<\/strong>.
\n13. After the policy creates successfully, go ahead and review it. Notice in the Overview<\/strong> blade that it is currently disabled<\/strong>. <\/p>\n

\"waf<\/p>\n

When the policy is enabled, the rule I created should check the request against the condition and block access from my local machine\u2019s IP to site2.hiteshvadgama.co.uk<\/strong> while still allowing access to site1.hiteshvadgama.co.uk<\/strong>.<\/p>\n

Testing the custom rule<\/strong><\/p>\n

Before I enable the policy, I verify that I can currently access both site1<\/strong> and site2.hiteshvadgama.co.uk<\/strong> from my local machine. From the browser, I can reach the simple HTML page I created on each site:<\/p>\n

\"waf<\/p>\n

\"waf<\/p>\n

 Now I go and enable the WAF policy:<\/p>\n

\"waf<\/p>\n

When I now try to browse to site2.hiteshvadgama.co.uk<\/strong>, I get a `403` status error: <\/p>\n

\"waf<\/p>\n

However, when I browse to site1.hiteshvadgama.co.uk<\/strong>, I still have access: <\/p>\n

\"waf<\/p>\n

Conclusion <\/strong><\/p>\n

This series describes how to implement a per-site WAF policy with a custom rule to an Application Gateway to control inbound access based on IP address-based restrictions.  <\/p>\n

Custom rules are very powerful, and you can use many other variables beyond IP address matching to tailor rules to address-specific security policies for your web applications.<\/p>\n

This Microsoft article<\/a> provides a great overview of the capabilities of custom rules and more advanced scenarios.<\/p>\n","protected":false},"excerpt":{"rendered":"

Configuring a per-site WAF policy with IP address restriction rules: Part three<\/p>\n","protected":false},"author":2,"featured_media":8297,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26707","content_type":"blog","created_by":"10130","authored_on":"2024-03-13T14:41:26+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"Hitesh Vadgama, Solutions Architect, Rackspace Technology","seo_description":"Set up and test Web Application Firewall (WAF) policies with IP address restriction rules. Control inbound access to websites on Windows VMs.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26707-insights_image-general-code-technical-blog-3-insights.jpg","field_partners":"","rxt_platforms":"Microsoft Azure, Security","product":"","publisheddate":"2021-02-24T15:41:26","rxt_solutions":"Multicloud, Security","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Configuring a Per-Site WAF Policy Pt.3 | Rackspace Technology","field_topics":"","field_slug":"configuring-a-per-site-waf-policy-with-ip-address-restriction-rules-part-three","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-8295","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/8295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/comments?post=8295"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/8295\/revisions"}],"predecessor-version":[{"id":10028,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/8295\/revisions\/10028"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media\/8297"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media?parent=8295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/categories?post=8295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/tags?post=8295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}