Disabling IP Address Blocking for the Wallarm Scanner¶

Note that if you use the blocking mode of the filter node (the wallarm_mode directive) by default when detecting malicious requests, you must explicitly specify for the Wallarm scanner a list of IP addresses from which requests should not be blocked.

Suppose the following blocking settings are set in the NGINX configuration file:

geo $wallarm_mode_real {
    default block;          # Default blocking mode enabled
    1.1.1.1/24 monitoring;  # Monitoring mode (cancels blocking)
    2.2.2.2 off;            # Blocking mode for the address disabled
    ...
}
...
wallarm_mode $wallarm_mode_real;
...

The off directive is used keep each IP address reserved for the Wallarm scanner from being blocked.

To avoid overloading the NGINX configuration file, you can make a list of the IP addresses for the scanner in a separate file and then add its contents to the configuration file using the include directive.

For example, create the /etc/nginx/scanner-ip-list file:

# The list of the Wallarm scanner IP addresses
3.3.3.3 off;
4.4.4.4 off;
5.5.5.5 off;
...
# Add all the required IP addresses here

Now use the include directive to include this list in the required block of the configuration file:

geo $wallarm_mode_real {
    default block;
    1.1.1.1/24 monitoring;
    2.2.2.2 off;
    include /etc/nginx/scanner-ip-list;
}
...
wallarm_mode $wallarm_mode_real;