How to define IP whitelist in Azure Application Gateway (WAF) or Azure Firewall

Question

How to define IP whitelist in Azure Application Gateway (WAF) or Azure Firewall

Mohsen Akhavan 831

Based on this document, I used Azure Application Gateway (WAF) before Azure Firewall. Also, I have three backend pools (Web Apps). Now I want to limit access to some web apps with IP through Azure Application Gateway or Azure Firewall.
First Azure Application Gateway received a client request and there aren't any configuration to add (Allow/Deny) client IP. After that this request sent to Azure Firewall.

Now, I want to know are there any solution to limit access (IP) on Applization Gateway or Firewall?

User's image

Lassan, Csaba 0 Reputation points

2023-06-16T13:51:30.07+00:00

Hello @GitaraniSharma-MSFT
I know I am late to the thread, I arrived through a search for whitelisting, and did not find the answer in the accepted explanation.

Is it possible to implement this kind of whitelisting?

if request_uri matches regexp '^/secret' AND client_ip is in (1.2.3.4, 2.3.4.5) then allow else deny

Thank you!

Accepted answer

0 additional answers

Your answer

Lassan, Csaba 0 Reputation points

2023-06-16T13:51:30.07+00:00

Hello @GitaraniSharma-MSFT
I know I am late to the thread, I arrived through a search for whitelisting, and did not find the answer in the accepted explanation.

Is it possible to implement this kind of whitelisting?

if request_uri matches regexp '^/secret' AND client_ip is in (1.2.3.4, 2.3.4.5) then allow else deny

Thank you!

Answer 1

GitaraniSharma-MSFT 50,021 Microsoft Employee Moderator

Hello @Mohsen Akhavan ,

I understand that you would like to know how to block IP addresses (Client IP) in Azure Application gateway (WAF).

You can configure IP restriction on Azure Application gateway to allow access to a few sources IPs by using NSG on the Application Gateway subnet.

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#allow-access-to-a-few-source-ips

In case you are using Application Gateway WAF V2, you can use WAF V2 Custom rules to whitelist/block IP addresses.

Please refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview

The Azure Application Gateway Web Application Firewall (WAF) v2 can be associated to a WAF policy which contain all the WAF settings and configurations. This includes exclusions, custom rules, managed rules, and so on. Custom rules allow you to create your own rules that are evaluated for each request that passes through the WAF.

Allowing and blocking traffic is simple with custom rules. For example, you can allow/block all traffic coming from a range of IP addresses.

To allow something, ensure that the -Action parameter is set to Allow. To block something, ensure that the -Action parameter is set to Block.

You can create a Custom rule on Azure Application Gateway WAF v2 to block all requests from an IP address/range.

You can use the "RemoteAddr" variable which is the IPv4 Address/Range of the remote computer connection with operator IPMatch to create such a rule and block all requests from a particular IP address and range.

Example reference: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-custom-waf-rules#example-3

To create custom rules, you first need to create a Web Application Firewall policy for Application Gateway.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

Once the WAF policy is created, you can create a custom rule as below:

Associate the WAF policy to any of the below combination:

Your application gateway - When you associate a WAF policy globally, every site behind your Application Gateway WAF is protected with the same managed rules, custom rules, exclusions, and any other configured settings.
Any specific listener - With per-site WAF policies, you can protect multiple sites with differing security needs behind a single WAF by using per-site policies.
Any path-based rules - If there are certain pages within a single site that require different policies, you can make changes to the WAF policy that only affect a given URI.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Mohsen Akhavan 831 Reputation points

2023-02-11T20:24:31.6966667+00:00

@GitaraniSharma-MSFT Many thanks for your response. I read custom rule policy document. My WAF mode is Detection. I saw this note on document.

If the WAF policy is set to detection mode, and a custom block rule is triggered, the request is logged and no blocking action is taken.

It means I cannot block request from specific IP. Am I right?
Mohsen Akhavan 831 Reputation points

2023-02-12T10:52:38.39+00:00

@GitaraniSharma-MSFT Another question, Is it possible to assign a custom rule to a specific listener or backend pool?
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-02-12T12:37:03.6166667+00:00
Yes, that is correct, @Mohsen Akhavan . If the WAF policy is set to detection mode, and a custom block rule is triggered, the request is logged, and no blocking action is taken.

The custom rule will only block the IP addresses if the WAF is set to Prevention mode.

Prevention mode - Blocks the transaction based on SecDefaultAction. Just like the Allow action, once the request is evaluated and added to the blocklist, evaluation is stopped, and the request is blocked. Any request after that meets the same conditions won't be evaluated and will just be blocked.

Detection mode - Logs the transaction based on SecDefaultAction after which evaluation is stopped. Any request after that meets the same conditions won't be evaluated and will just be logged.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview#action-required

Is it possible to assign a custom rule to a specific listener or backend pool?

To create custom rules, you first need to create a Web Application Firewall policy for Application Gateway.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

You cannot assign a custom rule directly to a specific listener, but you can associate a WAF policy (where the custom rule to block the specific IP addresses is configured) to a specific listener.

There's no limit on the number of policies you can create. When you create a policy, it must be associated to an application gateway to take effect. It can be associated with any combination of application gateways, listeners, and path-based rules.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview

Regards,

Gita
Mohsen Akhavan 831 Reputation points

2023-02-12T14:39:07.9266667+00:00

@GitaraniSharma-MSFT Thanks. So, based on your comments and documents, the only solution to limit access to specific listener is custom WAF policy.
I think, the assign NSG to Application Gateway subnet it's not possible to limit access to specific listener. What is your suggestion?

Just for your information, my request is limiting access to some my apps (behind WAF) from specific IP.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-02-13T09:41:05.0166667+00:00

@Mohsen Akhavan , yes, it is not possible to limit access to specific listener using NSG on the Application gateway. When you associate a NSG to restrict source IPs to Application gateway, it will restrict the access to your whole Application gateway from a few source IPs.

If you see the doc explaining how Application gateway works, you can see that, if your backend pool contains an internally resolvable FQDN or a private IP address, the application gateway routes the request to the backend server by using its instance private IP addresses.

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/how-application-gateway-works

Also, in your setup when a client starts the connection to the public IP address of the Azure Application Gateway, the request to the Application Gateway public IP is distributed to a back-end instance of the gateway. The Application Gateway instance stops the connection from the client and establishes a new connection with one of the back ends. And then the UDR on the Application Gateway subnet forwards the packet to the Azure Firewall, while preserving the destination IP to the web application.

Refer: https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway#workflow-2

So, the NSG applied on the Application gateway will not impact the routing of request to the backend pool as long as the source IPs are allowed to access the Application gateway subnet because the Application gateway instance will create a new connection to the backend pool, and this cannot be controlled on NSG level as you cannot differentiate the traffic based on the client source IP.

The best way to limit to the access to some apps from specific IPs would be via WAF custom rules on specific listener as the application gateway accepts incoming traffic on a listener and if a web application firewall (WAF) is in use, the application gateway checks the request headers and the body, if present, against WAF rules. This action determines if the request is valid request or a security threat. If the request is valid, it's routed to the backend. If the request isn't valid and WAF is in Prevention mode, it's blocked as a security threat.

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/how-application-gateway-works#how-an-application-gateway-accepts-a-request

Hope this clarifies!

Regards,

Gita
Mohsen Akhavan 831 Reputation points

2023-06-09T08:38:32.3+00:00

Hi @GitaraniSharma-MSFT , Could you please check my last question:
[https://learn.microsoft.com/en-us/answers/questions/1302457/how-to-limit-access-to-web-app-with-waf-(detection](https://learn.microsoft.com/en-us/answers/questions/1302457/how-to-limit-access-to-web-app-with-waf-(detection)
Lassan, Csaba 0 Reputation points

2023-06-16T13:49:27.7966667+00:00

I know I am late to the thread, I arrived through a search for whitelisting, and did not find the answer in the accepted explanation.

Is it possible to implement this kind of whitelisting?

if request_uri matches regexp '^/secret' AND client_ip is in (1.2.3.4, 2.3.4.5) then allow else deny

Thank you!
Lassan, Csaba 0 Reputation points

2023-06-16T14:40:43.82+00:00

I found it, never mind...
You can add 2 conditions to a custom rule in your policy.

One is

IF MatchType String, MatchVariable RequestUri is regex ^/secret

Second is

ANDIF MatchType IP address, Match variable RemoteAddr does not contain 1.2.3.4

Action

THEN Deny Traffic
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-06-19T12:20:29.1533333+00:00

Hello Lassan, Csaba, I see that you found the solution for your requirement. Thank you for sharing the solution and we appreciate your continued contribution on Q&A.
Shum Kenneth 51 Reputation points

2023-08-17T08:42:57.33+00:00

How am I able to set the waf to allow certain ip through, but need them to be scanned by managed rules too.

I set custom rules to allow a list of IPs, then block everything else.

But I found the traffic allowed through the firewall will be excluded from the managed rules.

Share via

How to define IP whitelist in Azure Application Gateway (WAF) or Azure Firewall

0 additional answers

Your answer