1. Setup Htaccess
- Grab the applicable .htaccess file for Sucuri/Cloudflare WAF for your Webserver. Please note: for Litespeed Enterprise it works with standard Apache .htacces directives so use Apache version.
Sucuri: https://gitlab.com/mikeramsey/apache-htaccess-rules/tree/master/Sucuri
Cloudflare: https://gitlab.com/mikeramsey/apache-htaccess-rules/tree/master/Cloudflare - If
you have not already done so I recommend backing up your current
.htaccess before proceeding. This will allow you to revert the changes
if needed due to an error.
- Place the content of the .htaccess file into the top of your current .htaccess file in the document root for the website.
2. Whitelist WAF IP’s in Server firewall and AntiDDos Settings.
- Get IPS to whitelist and ignore the Sucuri/Cloudflare IP’s in your firewall.
You can get the Sucuri or Cloudflare current IP’s from the below links.
2. Whitelist IP in CSF Firewall this can be done in the main allow file and ignore file./etc/csf/csf.allow
/etc/csf/csf.ignore
- You
can also set up a custom allow file and include its path in the main
one “/etc/csf/csf.allow” and the ignore file “/etc/csf/csf.ignore” files
like the below.
Include /etc/csf/cloudflare.allow
orInclude /etc/csf/sucuri.allow - To add this include for CF:
echo 'Include /etc/csf/cloudflare.allow' >> /etc/csf/csf.allow
echo 'Include /etc/csf/cloudflare.allow' >> /etc/csf/csf.ignore - To easily generate the /etc/csf/cloudflare.allow with the current IP’s the below commands will add both IPv4/IPV6 IPs.
curl -s https://www.cloudflare.com/{ips-v4,ips-v6}|sort| tee /etc/csf/cloudflare.allow - To add this include for Sucuri:
echo 'Include /etc/csf/sucuri.allow' >> /etc/csf/csf.allow
echo 'Include /etc/csf/sucuri.allow' >> /etc/csf/csf.ignore - To
easily grab the Sucuri IPs from the command line the below curl with
regex will parse the unique IPv4/IPv6 cidr ranges to
/etc/csf/sucuri.allow
curl -s https://docs.sucuri.net/website-firewall/troubleshooting/bypassing-the-waf-for-testing/ |grep -E -o "((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$)|(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|(s((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)"| grep -v '208.104.52.26' | tee /etc/csf/sucuri.allow - You can then restart CSF firewall completely like the below.
csf -ra
To fetch these IP’s and update automatically you can something like this in a cron:
Cloudflare:CSF_BIN=$(which csf); curl -s https://www.cloudflare.com/{ips-v4,ips-v6}|sort| tee /etc/csf/cloudflare.allow; $CSF_BIN -ra;
Cron script: https://gitlab.com/mikeramsey/apache-htaccess-rules/blob/master/Cloudflare/csf_cf_allow.sh
Sucuri: Cron Script
https://gitlab.com/mikeramsey/apache-htaccess-rules/blob/master/Sucuri/csf_sucuri_allow.sh
Special Notes for Openlitespeed/Litespeed users.
The setting for “Use Client IP in Header” in the OLS/LS Web Admin panel Server Configuration > General should be set to NO or unset. If this is enabled it will cause a 403 Forbidden for all requests as it will be using the client’s real IP vs the CF/Sucuri IP which is whitelisted.
Use Client IP in Header
Specifies whether to use the IP address listed in the “X-Forwarded-For”
HTTP request header for all IP address-related features, including
connection/bandwidth throttling, access control, and IP geolocation.
This
feature is useful if your web server is behind a load balancer or a
proxy server. If you select “Trusted IP Only”, then X-Forwarded-For IP
will be used only when the request is coming from trusted IPs defined in
the server-level “Allowed List”.
“Keep Header from
Trusted IP” is the same as “Trusted IP Only”, but the X-Forwarded-For
header used for the backend will not be modified to include the
connecting peer address.”
The Sucuri/Cloudflare WAF IPs should be set to trusted so they are not blocked/rate limited by the OLS/LS AntiDDos Settings.
References:
https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:show-real-ip-behind-cloudflare
https://docs.sucuri.net/website-firewall/troubleshooting/same-ip-for-all-users/#litespeed
https://docs.sucuri.net/website-firewall/troubleshooting/bypassing-the-waf-for-testing/
Sucuri IP’s
ALL, 192.88.134.0/23T, 185.93.228.0/22T, 66.248.200.0/22T, 208.109.0.0/22T, 2a02:fe80::/29T
Cloudflare IP’s
ALL,
173.245.48.0/20T, 103.21.244.0/22T, 103.22.200.0/22T, 103.31.4.0/22T,
141.101.64.0/18T, 108.162.192.0/18T, 190.93.240.0/20T, 188.114.96.0/20T,
197.234.240.0/22T, 198.41.128.0/17T, 162.158.0.0/15T, 104.16.0.0/12T,
172.64.0.0/13T, 131.0.72.0/22
Combined:
ALL,
173.245.48.0/20T, 103.21.244.0/22T, 103.22.200.0/22T, 103.31.4.0/22T,
141.101.64.0/18T, 108.162.192.0/18T, 190.93.240.0/20T, 188.114.96.0/20T,
197.234.240.0/22T, 198.41.128.0/17T, 162.158.0.0/15T, 104.16.0.0/12T,
172.64.0.0/13T, 131.0.72.0/22, 192.88.134.0/23T, 185.93.228.0/22T,
66.248.200.0/22T, 208.109.0.0/22T, 2a02:fe80::/29T
If you have all lots of sites on the same server and they all use Cloudflare/Sucuri you could set Global/Vhost level Acess Control to Allow only the trusted IP’s to access the server in OLS/LS Web Admin. This would allow you to set it up once for all sites on the server. Please note this may break any proxy subdomains that do not work behind the WAF for Control Panel’s unless custom rules are setup.
This would be done in the menu:
Server Configuration > Security >Access Control:
Allowed List
173.245.48.0/20T, 103.21.244.0/22T, 103.22.200.0/22T, 103.31.4.0/22T,
141.101.64.0/18T, 108.162.192.0/18T, 190.93.240.0/20T, 188.114.96.0/20T,
197.234.240.0/22T, 198.41.128.0/17T, 162.158.0.0/15T, 104.16.0.0/12T,
172.64.0.0/13T, 131.0.72.0/22, 192.88.134.0/23T, 185.93.228.0/22T,
66.248.200.0/22T, 208.109.0.0/22T, 2a02:fe80::/29T
Denied List ALL,
This will by default deny all hosts and only allow the Sucuri/Cloudflare WAF IPS in the “Allowed List”.
Once
again if doing this please ensure you whitelist any VPN/Static IP’s
also used for Management of the control panel and ensure that the option
“Use Client IP in Header” is set to “no” so your not locked out.
3. Test bypass protection
Sucuri Has a nice guide about how to do this.
https://docs.sucuri.net/website-firewall/troubleshooting/bypassing-the-waf-for-testing/
1. Update hosts file.
Linux/MacOS
/etc/hosts
Windows
c:\windows\system32\drivers\etc
Format: domain.tld www.domain.tld 1.2.3.4 example.com www.example.com
When done testing comment it out. # domain.tld www.domain.tld
2. Flush DNS after updating (Windows only). ipconfig /flushdns
3. Visit Site directly bypassing the WAF If all is working you should see a 403 Forbidden or whatever custom error you setup for the bypass proxy protection rewrite.
I hope you found this guide helpful and informative. If your looking for quality hosting definitely check us out.
from https://whattheserver.me/sucuri-cloudflare-waf-bypass-protection/
No comments:
Post a Comment