Add a web server protection (WAF) rule
With WAF rules, you can protect web applications from attacks and data leakage by filtering HTTP traffic.
You configure a WAF rule for an IP address assigned to a network interface, port, and one or more domain names. The firewall matches traffic based on the IP address assigned to the interface.
For HTTPS traffic, it uses Server Name Indication (SNI) to determine the server that corresponds to the hostname in the client request.
Restriction
You can only create up to 60 WAF rules. Exceeding the limit results in performance degradation and production impact. See WAF limitation.
- Go to Rules and policies > Firewall, select IPv4 and click Add firewall rule.
- Rules are turned on by default. You can turn off a rule if you don’t want to apply its matching criteria.
-
Enter the general details.
Setting Description Rule name Enter a name. Rule position Specify the position of the rule.
Available options:- Top
- Bottom
Rule group Specify the rule group to which you want to add the firewall rule. You can also create a new rule group by using Create new from the list.
If you select Automatic, the firewall rule is added to an existing group based on the first match with the rule type and source-destination zones.Action Select Protect with web server protection. Preconfigured template Select a template to apply:
- None: Specify the web server protection details.
- Exchange Autodiscover
- Exchange Outlook Anywhere
- Exchange General
- Microsoft Lync
- Microsoft Remote Desktop Gateway 2008 and R2
- Microsoft Remote Desktop Web 2008 and R2
- Microsoft Sharepoint 2010 and 2013
-
Enter the Hosted server details.
Name Description Hosted address Select the public IP address assigned to an interface through which users access the internal server or host. The WAF rule is bound to the IP address assigned to the interface.
You can use the public IP address assigned to the interface or use an alias to bind the required public IP address.
When a client establishes a connection and accesses the web server, the web server obtains the interface address of the web application firewall (WAF) and not the client’s IP address. The HTTP header
X-Forwarded-For
carries the client’s IP address.Listening port Enter the port number on which to reach the hosted web server. The defaults are port 80 for HTTP and port 443 for HTTPS.
You can use the same port (for example, 443) for SSL VPN and WAF. In this case, SSL VPN works on any IP address except the IP address (Hosted address) configured for WAF.
WAF can't share the same port as the user portal. The default user portal port is 443.
You can't use some ports as these are reserved by the firewall for system services. For details, see Reserved ports.
HTTPS If you turn this on, the hosted server is accessible through HTTPS and not through HTTP. HTTPS certificate If you selected HTTPS, select the certificate.
The domains of the selected certificate automatically appear under Domains and overwrite the existing ones.
The firewall supports SNI (Server Name Indication), allowing you to create more than one virtual web server that's accessible over the same IP address and port. You can assign a different certificate to each server. Servers are presented to clients based on the requested hostname.
To create or upload a certificate, go to Certificates > Certificates.
Redirect HTTP Select to redirect port 80 traffic to port 443. Domains Enter the FQDN configured for the web server, for example,
shop.example.com
.If you've turned on HTTPS, domain names of the selected HTTPS certificate show in the list. You can edit or delete these or add new domain names.
You can use the wildcard
*.
at the start of a domain name only.Example:
*.company.com
A single WAF policy supports multiple wildcard domains. Virtual web servers with wildcard domains are only matched when there are no virtual web servers with specific domains configured.
Example: A client request to the domain, test.company.com, will match with
test.company.com
before it matches with*.company.com
before matching with*.com
. -
Specify the details of the Protected servers. You can specify the web servers, authentication method, and allowed and blocked client networks. If you select path-specific routing, in addition to these settings, you can bind sessions to servers, specify the primary and backup servers, and use the WebSocket protocol.
Note
If you select multiple web servers, requests are balanced between the webservers.
If you don't want to configure path-specific routing, specify the Web servers and Access permissions.
Name Description Web server Select the web servers from the Web server list. Alternatively, you can create new ones. You can see the selected web servers under Selected web servers. Allowed client networks Specify the IP addresses and networks that can connect to the hosted web server.
The default value is Any IPv4. Keep the default value if you don't want to specify any IP addresses or networks. If you leave this setting blank, your WAF rule won't work, and the browser will show a "400 Bad Request" error.
Blocked client networks Specify the IP addresses and networks to block from connecting to the hosted web server. Authentication Specify an authentication profile for web applications. -
Select Path-specific routing to forward specific path requests to the selected web servers. For example, if you specify the domain
www.test.com
, the path/web
, and the web serverWeb server 1
, a request forwww.test.com/web
is forwarded toWeb server 1
.Note
The firewall doesn't evaluate requests based on the order of path listing. It applies the paths, starting with the longest path and ending with the default path route. The default path is used only if a more specific path doesn't match the request.
Some instances in which you can specify path-specific routing are as follows:
- Send requests with a specific path (example:
/products/
) to a specific web server. - Bind each session to a web server, using Sticky session cookie. Example: If you host an e-commerce site and want a single server to serve users for the duration of a shopping session.
- Send all requests to the specified web server with the others remaining as backup servers, using Hot-standby mode.
Name Description Default path (path /
)Select the edit button and select a web server for the default path. Requests that don't match a listed path are sent to the default route. If you delete the default route, the firewall denies requests that don't match a listed path with a 404 Not found
response.Add new path Select to add a new path.
You can add a path if you've added a web server.Path Enter the website path. Example: /products/
Web server Select the web servers from the Web server list. Alternatively, you can create new ones. You can see the selected web servers under Selected web servers. Authentication Specify an authentication profile for web applications. Allowed client networks Specify the IP addresses and networks that can connect to the hosted web server. The firewall only implements the protection for IP host type IP and Network. Don't specify an IP range or IP list. Blocked client networks Specify the IP addresses and networks to block from connecting to the hosted web server.
The firewall only implements the protection for IP host type IP and Network. Don't specify an IP range or IP list.
Sticky session cookie Turn it on to bind a session to a web server. Sophos Firewall forwards a cookie to the user’s browser, enabling it to route requests from the browser to the same web server.
If the server isn't available, the cookie is updated, and the session is switched to another web server.Hot-standby mode Turn it on to send all requests to the first selected web server. The other web servers remain as backup servers and are used if the first server fails.
When the main server starts functioning again, the sessions are switched back to it. If you select Sticky session cookie, the session continues with the backup web server.WebSocket passthrough Turn it on to allow applications hosted on the specified site path to use the WebSocket protocol.
Since RFC standards don't specify the protocol's data format, checks can't be implemented and WebSocket traffic is allowed without protection. - Send requests with a specific path (example:
-
Select Add new exception to specify the security checks to skip.
Select the paths, sources, categories, and security checks to skip. For more information about categories, see the Common threat filter settings in Add a protection policy.
You can specify more than one exception in a WAF rule.
Name Description Paths Specify the paths for which you want to create an exception.
The path is case-sensitive. You can use wildcards in the paths.
Example:
/products/\*/images/\*
Operation Select the Boolean operation for paths and source networks. Sources Specify the IP addresses, range, list, or networks from which the traffic originates. Cookie signing Skips check for cookie tampering. Cookie signing mitigates attempts to obtain private session data and engage in fraudulent activity by tampering with cookies. When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built from the primary cookie's name and value and a secret known only to the firewall. If a request can't provide the correct cookie pair, the cookie is dropped. Static URL hardening Allows rewritten links for the specified paths and source networks.
Static URL hardening prevents users from manually constructing deep links that lead to unauthorized access. When a client requests a website, all static URLs of the website are signed using a procedure similar to cookie signing. In addition, the response from the web server is analyzed regarding which links can be validly requested next.
When you turn on static URL hardening, the entries for URL paths become case-sensitive. For example, if you add the path
/rule.html
and users enter/Rule.html
, the firewall reports that the signature can't be found.Form hardening Skips checks for web form rewriting. To prevent tampering with forms, the firewall saves the original structure of a web form and signs it. If the structure has changed when the form is submitted, the firewall rejects the request. Antivirus Skips anti-virus scanning for requests from the specified source networks and to the paths that you specify. Block clients with bad reputation Skips checks for clients that have a bad reputation according to real-time blackhole lists (RBLs) and GeoIP information. Never change HTML during static URL hardening or form hardening If you select this exception, the firewall doesn't perform an HTML rewrite during static URL hardening or form hardening. For example, it doesn't update the links inside an HTML page and retains the full link returned by the web server. You may have to skip static URL hardening or form hardening to allow access to these links. So, if a web application needs anything in the HTML page to function, it isn't dropped by HTML rewrite. Accept unhardened form data Even if you select the Form hardening exception, the firewall doesn't accept form data if the form hardening signature is missing. With this option, the firewall accepts unhardened form data. -
Specify the advanced protection policies.
Name Description Protection Specify a protection policy for the servers. Intrusion prevention Specify an intrusion prevention policy.
The communication protocol between the firewall and the web server must be HTTP to use intrusion prevention with WAF.
Traffic shaping Specify a traffic shaping policy to allocate bandwidth. -
Specify the Advanced settings.
Name Description Disable compression support When clients request compressed data, the firewall sends data in compressed form.
Select this setting to turn off compression if web pages appear incorrectly or if users experience content-encoding errors. The firewall then requests uncompressed data from web servers and sends it to the client irrespective of the request’s encoding parameter.
Rewrite HTML Select to rewrite the links of returned web pages to retain link validity.
Example: If a web server's hostname isyourcompany.local
, but the hosted web server’s hostname isyourcompany.com
, absolute links like[a href="http://yourcompany.local/"]
are broken if the link is not rewritten to[a href="http://yourcompany.com/"]
before delivery to the client.
You don't need to select this option ifyourcompany.com
is configured on your web server or if internal links on your web pages are always realized as relative links.
We recommend that you use the option with Microsoft Outlook web access or SharePoint portal server.
HTML rewriting affects all files with HTTP content type text/* or *xml*. * is a wildcard. To prevent corruption during HTML rewriting, make sure that other file types (example: binary files) have the correct HTTP content type.Rewrite cookies Select to rewrite cookies of the returned web pages. Pass host header Select to forward the host header requested by the client to the web server.
You can use this to match the requested hostname with the web server when you've hosted more than one website on a server. -
Click Save. When you save a new or edited web server protection rule, the firewall restarts all web server rules. Live connections using any of these rules will be lost and need to be re-established.
You can see the WAF rule you created in the Firewall rules table.
More resources