Hi All,
Sometimes small simple checks, or boobytraps as I like to call them, can have big results.
I am sure there are all kind of smart people here that do smart things to protect the websites behind the WAF. With the FortiWeb as the Swiss Army Kniife we can do it. I would like to collect little tricks here so we can all benefit.
Let me start wih a very simple one that will stop 95% of the automated scriptkiddies before they can start poking in your website.
Custom Rule: IP_Connect_Block
--------------------------------------------
Action: Block Period: 3600
Filter Type: HTTP Header
Header Name: Host
Header Value Type: Simple String
Header Value: 1.2.3.4 (Ip Adress)
Result:
Any connection to the website on the IP 1.2.3.4, instead of the DNS name, will block the source IP for 1 hour.
Requirement:
use DNS names
Why is this effective? Because lots of scans are done on complete IP blocks on IP address and not on names. This will protect you to be a collateral scan victim. And the easier you will block connections the less resources it will take also.
Greetz
Franklin
