Imperva Cyber Community

communities_1.jpg
 View Only

  • 1.  Block invalid IP

    Posted 12-07-2022 10:25
    Edited by Jose Yero 12-31-2022 08:26
    .


  • 2.  RE: Block invalid IP

    Posted 12-07-2022 12:57
    Hi,

    Use does not match regex match operation



    Use the below regex:

    ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$


    This will effectively block all request where the parameter IP is not a valid IP address.

    You can try out the regex here.

    Note: this is for any valid IP, including reserved IP addresses like 127.0.0.1, 0.0.0.54, 169.0.0.1 etc.

    Regards,


    ------------------------------
    Sarvesh Lad
    Tech Lead @ On-Prem Managed Services (WAF, DAM, DRA & Sonar)
    ------------------------------

    Original Message


  • 3.  RE: Block invalid IP

    Posted 12-08-2022 02:15
    Hi Jorge,
    Or you can check the events/alerts being hit by those non-valid iPs you've mentioned then set an action to block if it has an action - None.

    Alerts/Violations then filter that specific site that you wanted your policy to be applied.

    My 2 cents.

    Thank you.
    A
    Original Message