{"id":7206,"date":"2021-02-18T16:50:52","date_gmt":"2021-02-18T16:50:52","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/configuring-a-per-site-waf-policy-with-ip-address-restriction-rules-part-one\/"},"modified":"2026-11-03T19:28:13","modified_gmt":"2026-11-03T19:28:13","slug":"configuring-a-per-site-waf-policy-with-ip-address-restriction-rules-part-one","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/configuring-a-per-site-waf-policy-with-ip-address-restriction-rules-part-one\/","title":{"rendered":"Configuring a per-site WAF policy with IP address restriction rules: Part one"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

I recently worked with a client who had multiple public-facing Internet Information Services (IIS) websites hosted on an Azure\u00ae virtual machine (VM). The client wanted to restrict inbound internet access to one specific website by specifying a set of allowed external IP addresses and leave the traffic flow for the other websites unaffected.<\/p>\n

A common approach to achieve this is to use an Application Gateway web application firewall (WAF) in front of the target VM. Then, create a per-site WAF policy with an IP-based access control rule and assign it to the Application Gateway and the listener that corresponds to
\nthe particular website\u2019s hostname.<\/p>\n

An IP\u2013based access control rule is a custom WAF rule that lets you control access to your web applications. It does this by specifying a list of IP addresses or IP address ranges in Classless Inter-Domain Routing (CIDR) format<\/p>\n

By assigning WAF policies to a listener, you can configure WAF settings for individual sites without the changes affecting every site. The most specific policy takes precedence. Suppose there is a global policy and a per-site policy (a WAF policy associated with a listener). In that case, the per-site policy overrides the global WAF policy for that listener. Other listeners without their own policies are affected by only the global WAF policy.<\/p>\n

 
\nIn this series of posts, I run through a simplified configuration to demonstrate how to apply a per-site WAF policy to an Application Gateway to control inbound access based on IP-based restrictions to one of two test IIS websites running on a single Windows VM.<\/p>\n

\nThe following diagram provides a conceptual illustration of my goal:<\/p>\n

\"waf<\/p>\n

Implementation walkthrough <\/strong><\/p>\n

This three-post series covers the following elements of the implementation walkthrough:<\/p>\n

Post 1<\/a><\/p>\n

    \n
  1. Introduction<\/li>\n
  2. Assumptions<\/li>\n<\/ol>\n

    Post 2<\/a><\/p>\n

    \nApplication Gateway configuration:<\/p>\n

      \n
    1. Web application firewall<\/li>\n
    2. Backend pool<\/li>\n
    3. HTTP settings<\/li>\n
    4. Frontend IP configurations<\/li>\n
    5. Listeners<\/li>\n
    6. Rules<\/li>\n<\/ol>\n

      Post 3<\/a><\/p>\n

        \n
      1. WAF policy configuration<\/li>\n
      2. Testing the custom rule<\/li>\n
      3. Conclusion
        \n\t <\/li>\n<\/ol>\n

        Assumptions<\/strong><\/p>\n

        The following items are already in place, so I won’t cover the provisioning steps for these items in this walkthrough:<\/p>\n