Skip to content

Commit 4f69882

Browse files
mouraddmeirimouraddmeiri
authored
chore: add IP intelligence (#616)
1 parent fddf29b commit 4f69882

File tree

6 files changed

+337
-0
lines changed

6 files changed

+337
-0
lines changed

‎content/includes/nap-waf/config/common/ip-intelligence-conf.md

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
2+
3+
4+
As of NAP version 4.15.0 (for NAP V4 deployments), and NAP version 5.7.0 (for NAP V5 deployments), NGINX App Protect WAF includes a new feature named IP Intelligence. This features allows customizing the enforcement based on the source IP of the request to limit access from IP addresses with questionable reputation. Please note that:
5+
- The IP intelligence feature is disabled by default and needs to be explicitly enabled and configured in the policy.
6+
- The package `app-protect-ip-intelligence` needs to be installed (for NAP V4 deployments), or the IP Intelligence image deployed (for NAP V5 deployments), before configuring and using the feature. This package installs the client that downloads and updates the database required for enforcing IP Intelligence.
7+
8+
After installing the package or image, enable the feature in the following two places in the policy:
9+
1. By enabling the corresponding violation in the violation list: `"name": "VIOL_MALICIOUS_IP"` and assigning the required `block` and `alarm` values to the violation.
10+
11+
2. By enabling the featue in the corresponding IP Intelligence JSON section: `"ip-intelligence": {"enabled": true}` and define actions for the IP Intelligence categories listed below.
12+
13+
An example policy where both elements are enabled, and all the IP intelligence categories are configured to `block` and `alarm` can be found here:
14+
15+
```json
16+
{
17+
"policy": {
18+
"name": "ip_intelligency_policy",
19+
"template": {
20+
"name": "POLICY_TEMPLATE_NGINX_BASE"
21+
},
22+
"applicationLanguage": "utf-8",
23+
"caseInsensitive": false,
24+
"enforcementMode": "blocking",
25+
"blocking-settings": {
26+
"violations": [
27+
{
28+
"name": "VIOL_MALICIOUS_IP",
29+
"alarm": true,
30+
"block": true
31+
}
32+
]
33+
},
34+
"ip-intelligence": {
35+
"enabled": true,
36+
"ipIntelligenceCategories": [
37+
{
38+
"category": "Anonymous Proxy",
39+
"alarm": true,
40+
"block": true
41+
},
42+
{
43+
"category": "BotNets",
44+
"alarm": true,
45+
"block": true
46+
},
47+
{
48+
"category": "Cloud-based Services",
49+
"alarm": true,
50+
"block": true
51+
},
52+
{
53+
"category": "Denial of Service",
54+
"alarm": true,
55+
"block": true
56+
},
57+
{
58+
"category": "Infected Sources",
59+
"alarm": true,
60+
"block": true
61+
},
62+
{
63+
"category": "Mobile Threats",
64+
"alarm": true,
65+
"block": true
66+
},
67+
{
68+
"category": "Phishing Proxies",
69+
"alarm": true,
70+
"block": true
71+
},
72+
{
73+
"category": "Scanners",
74+
"alarm": true,
75+
"block": true
76+
},
77+
{
78+
"category": "Spam Sources",
79+
"alarm": true,
80+
"block": true
81+
},
82+
{
83+
"category": "Tor Proxies",
84+
"alarm": true,
85+
"block": true
86+
},
87+
{
88+
"category": "Web Attacks",
89+
"alarm": true,
90+
"block": true
91+
},
92+
{
93+
"category": "Windows Exploits",
94+
"alarm": true,
95+
"block": true
96+
}
97+
]
98+
}
99+
}
100+
}
101+
```
102+
This policy will basically block `"block": true` all IP addresses that are part of any threat category and add a log entry `"alarm": true` for the transaction.
103+
104+
The IP address database is managed by an external provider and is constantly updated (every 1 minute by default). The database also categorizes IP addresses into one or more threat categories. These are the same categories that can be configured individually in the IP intelligence section:
105+
- Anonymous Proxy
106+
- BotNets
107+
- Cloud-based Services
108+
- Denial of Service
109+
- Infected Sources
110+
- Mobile Threats
111+
- Phishing Proxies
112+
- Scanners
113+
- Spam Sources
114+
- Tor Proxies
115+
- Web Attacks
116+
- Windows Exploits
117+
118+
Note that since the IP address database is constantly updated, IP address enforcement is also expected to change. IP Addresses may be added, removed, or moved from one category to another based on the reported activity of the IP address.

‎content/nap-waf/ip-intelligence.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
2+
3+
If the deployment intends to use the IP intelligence Feature (avaiable from version 5.7.0), then the IP intelligence container needs to be added to the deployment in the docker compose file.
4+
5+
Modify the original `docker-compose.yml` file to include the additional IP Intelligence container:
6+
7+
```yaml
8+
services:
9+
waf-enforcer:
10+
container_name: waf-enforcer
11+
image: private-registry.nginx.com/nap/waf-enforcer:5.7.0
12+
environment:
13+
- ENFORCER_PORT=50000
14+
ports:
15+
- "50000:50000"
16+
volumes:
17+
- /opt/app_protect/bd_config:/opt/app_protect/bd_config
18+
- /var/IpRep:/var/IpRep
19+
networks:
20+
- waf_network
21+
restart: always
22+
user: "101:101"
23+
depends_on:
24+
- waf-ip-intelligence
25+
26+
waf-config-mgr:
27+
container_name: waf-config-mgr
28+
image: private-registry.nginx.com/nap/waf-config-mgr:5.7.0
29+
volumes:
30+
- /opt/app_protect/bd_config:/opt/app_protect/bd_config
31+
- /opt/app_protect/config:/opt/app_protect/config
32+
- /etc/app_protect/conf:/etc/app_protect/conf
33+
restart: always
34+
user: "101:101"
35+
network_mode: none
36+
depends_on:
37+
waf-enforcer:
38+
condition: service_started
39+
40+
waf-ip-intelligence:
41+
container_name: waf-ip-intelligence
42+
image: private-registry.nginx.com/nap/waf-ip-intelligence:5.7.0
43+
volumes:
44+
- /var/IpRep:/var/IpRep
45+
networks:
46+
- waf_network
47+
restart: always
48+
user: "101:101"
49+
50+
networks:
51+
waf_network:
52+
driver: bridge
53+
```
54+
55+
Notes:
56+
- Replace `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` tags with the actual release version tag you are deploying. We are using version 5.7.0 for this example deployment.
57+
- By default, the containers `waf-config-mgr`, `waf-enforcer` and `waf-ip-intelligence` operate with the user and group IDs set to 101:101. Ensure that the folders and files are accessible to these IDs.
58+
59+
Before you create the deployment in docker compose, create the directories:
60+
61+
```shell
62+
sudo mkdir -p /opt/app_protect/config /opt/app_protect/bd_config /var/IpRep
63+
```
64+
65+
Then set ownership:
66+
67+
```shell
68+
sudo chown -R 101:101 /opt/app_protect/ /var/IpRep
69+
```

0 commit comments

Comments
 (0)