WAF Rule Configuration Guide: Building Effective Web Protection

A WAF (Web Application Firewall) is a core component of web application security. Proper rule configuration determines WAF effectiveness.

1. WAF Rule Types

Rule Type Description Example
Blacklist Known attack pattern matching SQL injection patterns
Whitelist Only allow specified patterns IP whitelist
Rate Limiting Request frequency control 100 requests/minute
Behavioral Anomaly detection Crawler identification

2. OWASP CRS Ruleset

OWASP Core Rule Set is the industry standard for open source WAF rules.

# SQL injection detection
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES "/((\%3C)|<)[^]+((\%3E)|>)/" "phase:2,deny,msg:'XSS Attack'"

3. Cloudflare WAF Configuration

Rule Name: Block SQLi
Expression: http.request.uri.path contains "wp-admin" and http.request.method in {"POST"} and not ip.src in {192.0.2.0/24}
Action: Block

Rule Name: Rate Limit API
Expression: http.request.uri.path starts with "/api/"
Action: Managed Challenge
Rate Limit: 100 requests/10 minutes

4. False Positive Handling

False Positive Type Solution
IP incorrectly blocked Add to whitelist
Legitimate parameter misjudged Create rule exception
Normal behavior misjudged Adjust sensitivity
Special scenarios Create exclusion rules

5. Best Practices

  1. Start in log mode, confirm no false positives before blocking
  2. Regularly update rule libraries
  3. Monitor WAF logs, handle false positives promptly
  4. Combine IP reputation databases and geolocation