Skip to content

Commit 3279b5a

Browse files
kudriavitskyADubhlaoichmjang
authored
IP Groups in override-rules (#536)
* Create ip-groups-override-rules.md * Create ip-groups-overview.md * Update configuration.md add IP Groups * Update configuration.md add IP Groups in Policy Override Rules Conditions * Update content/includes/nap-waf/config/common/ip-groups-override-rules.md Co-authored-by: Alan Dooley <github@adubhlaoi.ch> * Update content/includes/nap-waf/config/common/ip-groups-overview.md Co-authored-by: Alan Dooley <github@adubhlaoi.ch> * Update content/includes/nap-waf/config/common/ip-groups-override-rules.md Co-authored-by: Alan Dooley <github@adubhlaoi.ch> * Update content/includes/nap-waf/config/common/ip-groups-override-rules.md Co-authored-by: Alan Dooley <github@adubhlaoi.ch> * Update content/includes/nap-waf/config/common/ip-groups-override-rules.md Co-authored-by: Alan Dooley <github@adubhlaoi.ch> * Update content/includes/nap-waf/config/common/ip-groups-override-rules.md Co-authored-by: Alan Dooley <github@adubhlaoi.ch> * Update content/includes/nap-waf/config/common/ip-groups-overview.md Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com> * Update content/includes/nap-waf/config/common/ip-groups-override-rules.md Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com> --------- Co-authored-by: Alan Dooley <github@adubhlaoi.ch> Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>
1 parent 9653f7b commit 3279b5a

File tree

4 files changed

+178
-0
lines changed

4 files changed

+178
-0
lines changed

‎content/includes/nap-waf/config/common/ip-groups-override-rules.md

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#### IP-Groups feature as part of Override Rules feature.
2+
3+
The Override Rules feature allows you to modify original or parent policy settings.
4+
5+
Rules are defined using specific conditions, which can include an IP group based on the declarative policy JSON schema.
6+
7+
When triggered, the rule is applied to the _clientIp_ attribute using the _matches_ function.
8+
9+
'clientIp.matches(ipAddressLists["standalone"])'
10+
11+
Here is a policy example:
12+
13+
```json
14+
{
15+
"policy": {
16+
"name": "ip_group_override_rule",
17+
"template": {
18+
"name": "POLICY_TEMPLATE_NGINX_BASE"
19+
},
20+
"applicationLanguage": "utf-8",
21+
"caseInsensitive": false,
22+
"enforcementMode": "blocking",
23+
"ip-address-lists": [
24+
{
25+
"name": "standalone",
26+
"description": "This is my list of IP addresses",
27+
"ipAddresses": [
28+
{
29+
"ipAddress": "6.5.3.3/32"
30+
},
31+
{
32+
"ipAddress": "6.5.4.2"
33+
}
34+
]
35+
}
36+
],
37+
"override-rules": [
38+
{
39+
"name": "myFirstRule",
40+
"condition": "clientIp.matches(ipAddressLists['standalone'])",
41+
"actionType": "violation",
42+
"violation": {
43+
"block": true,
44+
"alarm": true,
45+
"attackType": {
46+
"name": "Forceful Browsing"
47+
},
48+
"description": "Attempt to access from clientIp",
49+
"rating": 4
50+
}
51+
}
52+
],
53+
"general": {
54+
"trustXff": true
55+
}
56+
}
57+
}
58+
```
59+
60+
The previous example policy contains an IP group with the name "standalone", used for the override rule condition "clientIp.matches(ipAddressLists['standalone'])".
61+
The condition means that the rule enforcement is applied when clientIp is matched to one of ipAddresses in ipAddressList with name "standalone".
62+
The value used for the override condition must exist and exactly match the name in "ip-address-lists".
63+
64+
#### Possible errors
65+
66+
| Error text | Input | Explanation |
67+
| -----------| ------------- | ------------ |
68+
| _Invalid field invalidList_ | _clientIp.matches(invalidList['standalone']);_ | An incorrect keyword was used instead of _ipAddressLists_ |
69+
| _Invalid value empty string_ | _clientIp.matches(ipAddressLists['']_ | An empty name was provided |
70+
| _Failed to compile policy - 'ipGroupOverridePolicy'_ | _uri.matches(ipAddressLists['standalone']);_ | Used _ipAddressLists_ without the _clientIP_ attribute |
71+
72+
73+

‎content/includes/nap-waf/config/common/ip-groups-overview.md

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
IP groups is a feature to organize lists of allowed and forbidden IP addresses across several lists with common attributes.
2+
3+
This allows you to control unique policy settings for incoming requests based on specific IP addresses.
4+
5+
Each IP Group contains a unique name, enforcement type (_always_, _never_ and _policy-default_), and list of IP addresses.
6+
7+
8+
An example of a declarative policy using IP Groups configuration:
9+
10+
```json
11+
{
12+
"policy": {
13+
"name": "IpGroups_policy",
14+
"template": {
15+
"name": "POLICY_TEMPLATE_NGINX_BASE"
16+
},
17+
"applicationLanguage": "utf-8",
18+
"caseInsensitive": false,
19+
"enforcementMode": "blocking",
20+
"ip-address-lists": [
21+
{
22+
"name": "Standalone",
23+
"description": "Optional Description",
24+
"blockRequests": "policy-default",
25+
"setGeolocation": "IN",
26+
"ipAddresses": [
27+
{
28+
"ipAddress": "1.2.3.4/32"
29+
},
30+
{
31+
"ipAddress": "1111:fc00:0:112::2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
}
38+
39+
```
40+
The example with IP-Group definition in external file external_ip_groups.json:
41+
42+
```json
43+
{
44+
"policy": {
45+
"name": "IpGroups_policy2",
46+
"template": {
47+
"name": "POLICY_TEMPLATE_NGINX_BASE"
48+
},
49+
"applicationLanguage": "utf-8",
50+
"caseInsensitive": false,
51+
"enforcementMode": "blocking",
52+
"ip-address-lists": [
53+
{
54+
"name": "external_ip_groups",
55+
"description": "Optional Description",
56+
"blockRequests": "always",
57+
"setGeolocation": "IL",
58+
"ipAddresses": [
59+
{
60+
"ipAddress": "31.8.194.27"
61+
}
62+
],
63+
"$ref": "file:///tmp/policy/external_ip_groups.json"
64+
}
65+
]
66+
}
67+
}
68+
```
69+
Example of the file external_ip_groups.json
70+
71+
```json
72+
{
73+
"name": "External Ip Groups List",
74+
"description": "Optional Description",
75+
"blockRequests": "always",
76+
"setGeolocation": "IR",
77+
"ipAddresses": [
78+
{
79+
"ipAddress": "66.51.41.21"
80+
},
81+
{
82+
"ipAddress": "66.52.42.22"
83+
}
84+
]
85+
}
86+
```

‎content/nap-waf/v4/configuration-guide/configuration.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -478,6 +478,15 @@ For the full reference of Override Rules condition syntax and usage see the NGIN
478478

479479
{{< include "nap-waf/config/common/geolocation-override-rules.md" >}}
480480

481+
## IP Groups
482+
483+
### Overview
484+
485+
{{< include "nap-waf/config/common/ip-groups-overview.md" >}}
486+
487+
### IP Groups in Policy Override Rules Conditions
488+
489+
{{< include "nap-waf/config/common/ip-groups-override-rules.md" >}}
481490

482491
## JSON Web Token Protection
483492

‎content/nap-waf/v5/configuration-guide/configuration.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -475,6 +475,16 @@ For the full reference of Override Rules condition syntax and usage see the NGIN
475475

476476
{{< include "nap-waf/config/common/geolocation-override-rules.md" >}}
477477

478+
## IP Groups
479+
480+
### Overview
481+
482+
{{< include "nap-waf/config/common/ip-groups-overview.md" >}}
483+
484+
### IP Groups in Policy Override Rules Conditions
485+
486+
{{< include "nap-waf/config/common/ip-groups-override-rules.md" >}}
487+
478488
## JSON Web Token Protection
479489

480490
### Overview

0 commit comments

Comments
 (0)