ASM/WAF rate limit and block clients by source ip (or device_id fingerprint if needed) if there are too many violations by them

Question

You can see my code about how to block users by source ip address that test if the servers and are vunrable to web attacks:&nbsp;&nbsp;&nbsp;https://devcentral.f5.com/s/articles/ASM-WAF-rate-limit-and-block-clients-by-source-ip-if-there-are-too-many-violations&nbsp;&nbsp;&nbsp;when RULE_INIT {&nbsp;&nbsp;&nbsp;&nbsp;# The max requests served within the timing interval per the static::timeout variable&nbsp;&nbsp;&nbsp;&nbsp;set static::maxReqs 3&nbsp;&nbsp;&nbsp;&nbsp;# Timer Interval in seconds within which only static::maxReqs Requests are allowed.&nbsp;&nbsp;&nbsp;&nbsp;# (i.e: 10 req per 2 sec == 5 req per sec)&nbsp;&nbsp;&nbsp;&nbsp;# If this timer expires, it means that the limit was not reached for this interval and&nbsp;&nbsp;&nbsp;&nbsp;# the request counting starts over. Making this timeout large increases memory usage.&nbsp;&nbsp;&nbsp;&nbsp;# Making it too small negatively affects performance.&nbsp;&nbsp;&nbsp;&nbsp;set static::timeout 60}&nbsp;&nbsp;&nbsp;&nbsp;#when CLIENT_ACCEPTED {&nbsp;#set cIP_addr [IP::client_addr]&nbsp;#&nbsp;&nbsp;&nbsp;set getcount [table lookup -notouch $cIP_addr]&nbsp;#&nbsp;&nbsp;&nbsp;if { ! ( [class match $cIP_addr equals ip_whitelist] ) } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# The following expects the IP addresses in multiple X-forwarded-for headers.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# It picks the first one. If XFF isn’t defined it can grab the true source IP.&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if {&nbsp;$getcount &gt; $static::maxReqs&nbsp;} {#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "Request Count for $cIP_addr is $getcount"#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;drop&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} #&nbsp;&nbsp;&nbsp;}&nbsp;#}&nbsp;&nbsp;when HTTP_REQUEST {&nbsp;&nbsp;&nbsp;# Allows throttling for only specific URIs. List the URIs_to_throttle in a data group.&nbsp;&nbsp;&nbsp;# Note: a URI is everything after the hostname: e.g. /path1/login.aspx?name=user&nbsp;&nbsp;&nbsp;if { [HTTP::header exists X-forwarded-for] } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set cIP_addr [getfield [lindex&nbsp;[HTTP::header values X-Forwarded-For]&nbsp;0] "," 1]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} else {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set cIP_addr [IP::client_addr]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;set getcount [table lookup -notouch $cIP_addr]&nbsp;&nbsp;&nbsp;&nbsp;if { ! ( [class match $cIP_addr equals ip_whitelist] ) } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# The following expects the IP addresses in multiple X-forwarded-for headers.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# It picks the first one. If XFF isn’t defined it can grab the true source IP.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if {&nbsp;$getcount &gt; $static::maxReqs&nbsp;} {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "Request Count for $cIP_addr is $getcount"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;drop&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP::respond 403 content {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;html&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt;&lt;title&gt;HTTP Request denied&lt;/title&gt;&lt;/head&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;body&gt;Your HTTP requests are being blocked because of too many violations.&lt;/body&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/html&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;}}&nbsp;&nbsp;&nbsp;&nbsp;#when ASM_REQUEST_BLOCKING {&nbsp;when ASM_REQUEST_DONE {&nbsp;&nbsp;&nbsp;&nbsp;#log local0.debug "$$ASM::status$$ = [ASM::status]"&nbsp;&nbsp;&nbsp;&nbsp;if { [ASM::status] equals "blocked" } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Allows throttling for only specific URIs. List the URIs_to_throttle in a data group.&nbsp;&nbsp;&nbsp;# Note: a URI is everything after the hostname: e.g. /path1/login.aspx?name=user1&nbsp;#&nbsp;&nbsp;if { [class match [HTTP::uri] equals URIs_to_throttle] } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# The following expects the IP addresses in multiple X-forwarded-for headers.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# It picks the first one. If XFF isn’t defined it can grab the true source IP.&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set getcount [table lookup -notouch $cIP_addr]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if { $getcount equals "" } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;table set $cIP_addr "1" $static::timeout $static::timeout&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Record of this session does not exist, starting new record&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Request is allowed.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} else {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "Request Count for $cIP_addr is $getcount"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;table incr -notouch $cIP_addr&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# record of this session exists but request is allowed.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;#&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;}}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EDIT:&nbsp;&nbsp;&nbsp;Please carefully read documentation for the code as the ASM session tracking and session awerness (https://support.f5.com/csp/article/K02212345 ) are better futures as &nbsp;mentioned that can do simillar things but the idea for this irule to be less CPU intensive by blocking bad actors before the ASM processing.

nikoolayy1 · Answer

Here is an example with failover to using the client ip address if ASM fingerprint if it is equal to "0" (no device ID fingerprint available). As I mentioned better use the main irule for blocking by source IP address or for device fingerprint the session tracking and awareness (https://support.f5.com/csp/article/K02212345). &nbsp;I just played with this as the ASM fingerprint is not aways generated for a web request and you need to first enable a feature like web scraping or in the newer versions the unified bot defense (see https://devcentral.f5.com/s/question/0D51T00006kGZft/asm-fingerprinting-with-irule and the general articles https://support.f5.com/csp/article/K19556739 ), so this irule can be helpfull if the default F5 features that use the fingerprint don't failover to client source IP address if there is no available fingerprint.&nbsp;&nbsp;&nbsp; I also created 2 subtables for the ip addresses and fingerprints for optimizing the lookups.&nbsp;&nbsp;&nbsp;Please read the full description of the code in:&nbsp;&nbsp;https://devcentral.f5.com/s/articles/ASM-WAF-rate-limit-and-block-clients-by-source-ip-if-there-are-too-many-violations?page=1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;when RULE_INIT {&nbsp;# The max requests served within the timing interval per the static::timeout variable&nbsp;set static::maxReqs 2&nbsp;# Timer Interval in seconds within which only static::maxReqs Requests are allowed.&nbsp;# (i.e: 10 req per 2 sec == 5 req per sec)&nbsp;# If this timer expires, it means that the limit was not reached for this interval and&nbsp;# the request counting starts over. Making this timeout large increases memory usage.&nbsp;# Making it too small negatively affects performance.&nbsp;set static::timeout 20&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;#when CLIENT_ACCEPTED {&nbsp;#set cIP_addr [IP::client_addr]&nbsp;#&nbsp;&nbsp;&nbsp;set getcount [table lookup -subtable "bad_ip" -notouch $cIP_addr]&nbsp;#&nbsp;&nbsp;&nbsp;if { ! ( [class match $cIP_addr equals ip_whitelist] ) } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# The following expects the IP addresses in multiple X-forwarded-for headers.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# It picks the first one. If XFF isn’t defined it can grab the true source IP.&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if {&nbsp;$getcount &gt; $static::maxReqs&nbsp;} {#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "Request Count for $cIP_addr is $getcount"#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;drop&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} #&nbsp;&nbsp;&nbsp;}&nbsp;#}&nbsp;&nbsp;&nbsp;&nbsp;when HTTP_REQUEST {&nbsp;&nbsp;&nbsp;# Allows throttling for only specific URIs. List the URIs_to_throttle in a data group.&nbsp;&nbsp;&nbsp;# Note: a URI is everything after the hostname: e.g. /path1/login.aspx?name=user&nbsp;&nbsp;&nbsp;if { [HTTP::header exists X-forwarded-for] } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set cIP_addr [getfield [lindex&nbsp;[HTTP::header values X-Forwarded-For]&nbsp;0] "," 1]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} else {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set cIP_addr [IP::client_addr]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;set getcount1 [table lookup -subtable "bad_ip" -notouch $cIP_addr]&nbsp;&nbsp;&nbsp;&nbsp;if { ! ( [class match $cIP_addr equals ip_whitelist] ) } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# The following expects the IP addresses in multiple X-forwarded-for headers.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# It picks the first one. If XFF isn’t defined it can grab the true source IP.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if {&nbsp;$getcount1&nbsp;&gt;= $static::maxReqs&nbsp;} {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "Request Count for $cIP_addr is $getcount1"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;drop&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP::respond 403 content {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;html&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt;&lt;title&gt;HTTP Request denied&lt;/title&gt;&lt;/head&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;body&gt;Your HTTP requests are being blocked because of too many violations.&lt;/body&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/html&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;}}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;when ASM_REQUEST_DONE {&nbsp;&nbsp;&nbsp;log local0.debug "$$ASM::status$$ = [ASM::status]&nbsp;&nbsp;and ASM_Device_id = [ASM::fingerprint] "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if { [ASM::status] equals "blocked" } {&nbsp;&nbsp;&nbsp;# Allows throttling for only specific URIs. List the URIs_to_throttle in a data group.&nbsp;# Note: a URI is everything after the hostname: e.g. /path1/login.aspx?name=user1&nbsp;if {&nbsp;not ( [class match [IP::client_addr] equals whitelist] ) } {&nbsp;# The following expects the IP addresses in multiple X-forwarded-for headers.&nbsp;# It picks the first one. If XFF isn’t defined it can grab the true source IP.&nbsp;set cIP_finger [ASM::fingerprint]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if { $cIP_finger == 0 } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if { $getcount1 equals "" } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;table set -subtable "bad_ip" $cIP_addr "1" $static::timeout $static::timeout&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Record of this session does not exist, starting new record&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Request is allowed.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} else {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "Request Count for $cIP_addr is $getcount1"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;table incr -subtable "bad_ip" -notouch $cIP_addr&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# record of this session exists but request is allowed.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;} else {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set getcount2 [table lookup -subtable "bad_id" -notouch $cIP_finger]&nbsp;&nbsp;if { $getcount2 equals "" } {&nbsp;table set -subtable "bad_id" $cIP_finger "1" $static::timeout $static::timeout&nbsp;# Record of this session does not exist, starting new record&nbsp;# Request is allowed.&nbsp;} else {&nbsp;if { $getcount2 &gt;= $static::maxReqs } {&nbsp;log local0. "Request Count for $cIP_finger is $getcount"&nbsp;table incr -subtable "bad_id" -notouch $cIP_finger&nbsp;# record of this session exists but request is allowed.&nbsp;} else {&nbsp;#drop&nbsp;HTTP::respond 403 content {&nbsp;&lt;html&gt;&nbsp;&lt;head&gt;&lt;title&gt;HTTP Request denied&lt;/title&gt;&lt;/head&gt;&nbsp;&lt;body&gt;Your HTTP requests are being throttled.&lt;/body&gt;&nbsp;&lt;/html&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;}

Forum Discussion

ASM/WAF rate limit and block clients by source ip (or device_id fingerprint if needed) if there are too many violations by them

1 Reply

Recent Discussions

CONNECTION IS LOST DUE TO SELF IP IS DELIVERED

ASM instance creation

Can iRule mask the payload content on event logs of security

Disacard SSL::cert mode to ignore when default SSLClient profile is set to request or require

F5Access | MacOS Sonoma

Related Content

ASM/WAF rate limit and block clients by source ip (or device_id fingerprint) if there are too many violations

Fingerprinting TLS Clients with JA4 on F5 BIG-IP

Use TLS Fingerprinting as a First Level of Defense in F5 Distributed Cloud

Howto enable BIG-IP ASM client fingerprinting

TLS Fingerprinting - a method for identifying a TLS client without decrypting