Skip to content

Filtration Mode

Filtration mode defines the filtering node behavior when processing incoming requests. These instructions describe available filtration modes and their configuration methods.

Available filtration modes

The Wallarm filtering node can process incoming requests in the following modes (from the mildest to the strictest):

  • Disabled (off)

  • Monitoring (monitoring)

  • Safe blocking (safe_blocking)

  • Blocking (block)

Wallarm node behavior off monitoring safe_blocking block
Analyzes whether incoming requests contain malicious payloads of the following types: input validation attacks, vpatch attacks, or attacks detected based on regular expressions - + + +
Uploads malicious requests to the Wallarm Cloud so that they are displayed in the event list - + + +
Blocks malicious requests - - Only those originated from graylisted IPs +
Blocks requests originated from denylisted IPssee exceptions + + + +
Blocks requests originated from graylisted IPs Does not analyze the graylist - Only those containing malicious payloads Does not analyze the graylist
Allows requests originated from allowlisted IPs + + + +

Exceptions

If wallarm_acl_access_phase off, the Wallarm node does not analyze the denylist in the off mode and does not block requests from denylisted IPs in the monitoring mode.

Methods of the filtration mode configuration

The filtration mode can be configured in the following ways:

  • Assign a value to the wallarm_mode directive in the filtering node configuration file

    Support of the wallarm_mode directive on the CDN node

    Please note that the wallarm_mode directive cannot be configured on the Wallarm CDN nodes. To configure the filtration mode of the CDN nodes, please use other available methods.

  • Define the general filtration rule in Wallarm Console

  • Create a filtration mode rule in the Rules section of Wallarm Console

Priorities of the filtration mode configuration methods are determined in the wallarm_mode_allow_override directive. By default, the settings specified in Wallarm Console have a higher priority than the wallarm_mode directive regardless of its value severity.

Specifying the filtration mode in the wallarm_mode directive

Support of the wallarm_mode directive on the CDN node

Please note that the wallarm_mode directive cannot be configured on the Wallarm CDN nodes. To configure the filtration mode of the CDN nodes, please use other available methods.

Using the wallarm_mode directive in the filtering node configuration file, you can define filtration modes for different contexts. These contexts are ordered from the most global to the most local in the following list:

  • http: the directives inside the http block are applied to the requests sent to the HTTP server.

  • server: the directives inside the server block are applied to the requests sent to the virtual server.

  • location: the directives inside the location block are only applied to the requests containing that particular path.

If different wallarm_mode directive values are defined for the http, server, and location blocks, the most local configuration has the highest priority.

The wallarm_mode directive usage example:

http {

    wallarm_mode monitoring;

    server {
        server_name SERVER_A;
    }

    server {
        server_name SERVER_B;
        wallarm_mode off;
    }

    server {
        server_name SERVER_C;
        wallarm_mode off;

        location /main/content {
            wallarm_mode monitoring;
        }

        location /main/login {
            wallarm_mode block;
        }

        location /main/reset-password {
            wallarm_mode safe_blocking;
        }
    }
}

In this example, the filtration modes are defined for the resources as follows:

  1. The monitoring mode is applied to the requests sent to the HTTP server.

  2. The monitoring mode is applied to the requests sent to the virtual server SERVER_A.

  3. The off mode is applied to the requests sent to the virtual server SERVER_B.

  4. The off mode is applied to the requests sent to the virtual server SERVER_C, except for the requests that contain the /main/content, /main/login, or the /main/reset-password path.

    1. The monitoring mode is applied to the requests sent to the virtual server SERVER_C that contain the /main/content path.
    2. The block mode is applied to the requests sent to the virtual server SERVER_C that contain the /main/login path.
    3. The safe_blocking mode is applied to the requests sent to the virtual server SERVER_C that contain the /main/reset-password path.

Setting up the general filtration rule in Wallarm Console

The radio buttons on the General tab of Wallarm Console settings in the US Wallarm Cloud or EU Wallarm Cloud define the general filtration mode for all incoming requests. The wallarm_mode directive value defined in the http block in the configuration file has the same action scope as these buttons.

The local filtration mode settings on the Rules tab of Wallarm Console have higher priority than the global settings on the Global tab.

On the General tab, you can specify one of the following filtration modes:

The general settings tab

The Wallarm Cloud and filtering node synchronization

The rules defined in Wallarm Console are applied during the Wallarm Cloud and filtering node synchronization process, which is conducted once every 2‑4 minutes.

More details on the filtering node and Wallarm Cloud synchronization configuration →

Setting up the filtration rules on the "Rules" tab

You can fine-tune the filtration mode for processing requests that meet your custom conditions on the Rules tab of Wallarm Console. These rules have higher priority than the general filtration rule set in Wallarm Console.

Creating and applying the rule

You can create and apply the rule both in the Attacks and Rules section of Wallarm Console.

  • In the Attacks section, rules are created with a pre-filled description of endpoints to apply the rule to. The endpoint description corresponds to the request you clicked the Rule button for.

    To complete the rule setup, just select the rule action type and make sure all rule components are configured correctly.

  • In the Rules section, all rule components must be filled in manually.

Default instance of rule

Wallarm automatically creates the instance of the Set filtration mode rule on the default level. The system sets its value on the basis of general filtration mode setting.

This instance of the rule cannot be deleted. To change its value, modify general filtration mode setting of the system.

As all the other default rules, the Set filtration mode default rule is inherited by all branches.

Example: Disabling Request Blocking During User Registration

If the following conditions take place:

  • new user registration is available at example.com/signup

  • it is better to overlook an attack than to lose a customer

Then, to create a rule disabling blocking during user registration

  1. Go to the Rules tab
  2. Find the branch for example.com/signup, and click Add rule
  3. Choose Set filtration mode
  4. Choose operation mode monitoring
  5. Click Create

Setting traffic filtration mode

API calls to create the rule

To create the filtration mode rule, you can call the Wallarm API directly besides using the Wallarm Console UI. Below is the example of the corresponding API call.

The following request will create the rule setting the node to filter traffic going to the application with ID 3 in the monitoring mode.

curl 'https://us1.api.wallarm.com/v1/objects/hint/create' -H 'X-WallarmApi-Token: <YOUR_TOKEN>' -H "accept: application/json" -H "Content-Type: application/json" --data-raw '{"clientid":<YOUR_CLIENT_ID>,"type":"wallarm_mode","mode":"monitoring","validated":false,"action":[{"point":["instance"],"type":"equal","value":"3"}]}'
curl 'https://api.wallarm.com/v1/objects/hint/create' -H 'X-WallarmApi-Token: <YOUR_TOKEN>' -H "accept: application/json" -H "Content-Type: application/json" --data-raw '{"clientid":<YOUR_CLIENT_ID>,"type":"wallarm_mode","mode":"monitoring","validated":false,"action":[{"point":["instance"],"type":"equal","value":"3"}]}'

The Wallarm Cloud and filtering node synchronization

The rules defined in Wallarm Console are applied during the Wallarm Cloud and filtering node synchronization process, which is conducted once every 2‑4 minutes.

More details on the filtering node and Wallarm Cloud synchronization configuration →

Setting up priorities of the filtration mode configuration methods using wallarm_mode_allow_override

Support of the wallarm_mode_allow_override directive on the CDN node

Please note that the wallarm_mode_allow_override directive cannot be configured on the Wallarm CDN nodes.

The wallarm_mode_allow_override directive manages the ability to apply rules that are defined on Wallarm Console instead of using the wallarm_mode directive values from the filtering node configuration file.

The following values are valid for the wallarm_mode_allow_override directive:

  • off: rules specified in Wallarm Console are ignored. Rules specified by the wallarm_mode directive in the configuration file are applied.

  • strict: only the rules specified in the Wallarm Cloud that define stricter filtration modes than those defined by the wallarm_mode directive in the configuration file are applied.

    The available filtration modes ordered from the mildest to the strictest are listed above.

  • on (by default): rules specified in Wallarm Console are applied. Rules specified by the wallarm_mode directive in the configuration file are ignored.

The contexts in which the wallarm_mode_allow_override directive value can be defined, in order from the most global to the most local, are presented in the following list:

  • http: the directives inside the http block are applied to the requests sent to the HTTP server.

  • server: the directives inside the server block are applied to the requests sent to the virtual server.

  • location: the directives inside the location block are only applied to the requests containing that particular path.

If different wallarm_mode_allow_override directive values are defined in the http, server, and location blocks, then the most local configuration has the highest priority.

The wallarm_mode_allow_override directive usage example:

http {

    wallarm_mode monitoring;

    server {
        server_name SERVER_A;
        wallarm_mode_allow_override off;
    }

    server {
        server_name SERVER_B;
        wallarm_mode_allow_override on;

        location /main/login {
            wallarm_mode_allow_override strict;
        }
    }
}

This configuration example results in the following applications of the filtration mode rules from Wallarm Console:

  1. The filtration mode rules defined in Wallarm Console are ignored for requests sent to the virtual server SERVER_A. There is no wallarm_mode directive specified in the server block that corresponds to the SERVER_A server, which is why the monitoring filtration mode specified in the http block is applied for such requests.

  2. The filtration mode rules defined in Wallarm Console are applied to the requests sent to the virtual server SERVER_B except for the requests that contain the /main/login path.

  3. For those requests that are sent to the virtual server SERVER_B and contain the /main/login path, the filtration mode rules defined in Wallarm Console are only applied if they define a filtration mode that is stricter than the monitoring mode.

Configuration of filtration mode example

Let us consider the example of a filtration mode configuration that uses all of the methods mentioned above.

Setting up filtration mode in the filtering node configuration file

http {

    wallarm_mode block;

    server { 
        server_name SERVER_A;
        wallarm_mode monitoring;
        wallarm_mode_allow_override off;

        location /main/login {
            wallarm_mode block;
            wallarm_mode_allow_override strict;
        }

        location /main/signup {
            wallarm_mode_allow_override strict;
        }

        location /main/apply {
            wallarm_mode block;
            wallarm_mode_allow_override on;
        }
    }
}

Setting up the filtration mode in Wallarm Console

  • General filtration rule: Monitoring.

  • Filtration rules:

    • If the request meets the following conditions:

      • Method: POST
      • First part of the path: main
      • Second part of the path: apply,

      then apply the Default filtration mode.

    • If the request meets the following condition:

      • First part of the path: main,

      then apply the Blocking filtration mode.

    • If the request meets the following conditions:

      • First part of the path: main
      • Second part of the path: login,

      then apply the Monitoring filtration mode.

Examples of requests sent to the server SERVER_A

Examples of the requests sent to the configured server SERVER_A and the actions that the Wallarm filtering node applies to them are the following:

  • The malicious request with the /news path is processed but not blocked due to the wallarm_mode monitoring; setting for the server SERVER_A.

  • The malicious request with the /main path is processed but not blocked due to the wallarm_mode monitoring; setting for the server SERVER_A.

    The Blocking rule defined in Wallarm Console is not applied to it due to the wallarm_mode_allow_override off; setting for the server SERVER_A.

  • The malicious request with the /main/login path is blocked due to the wallarm_mode block; setting for the requests with the /main/login path.

    The Monitoring rule defined in Wallarm Console is not applied to it due to the wallarm_mode_allow_override strict; setting in the filtering node configuration file.

  • The malicious request with the /main/signup path is blocked due to the wallarm_mode_allow_override strict; setting for the requests with the /main/signup path and the Blocking rule defined in Wallarm Console for the requests with the /main path.

  • The malicious request with the /main/apply path and the GET method is blocked due to the wallarm_mode_allow_override on; setting for the requests with the /main/apply path and the Blocking rule defined in Wallarm Console for the requests with the /main path.

  • The malicious request with the /main/apply path and the POST method is blocked due to the wallarm_mode_allow_override on; setting for those requests with the /main/apply path, the Default rule defined in Wallarm Console, and the wallarm_mode block; setting for the requests with the /main/apply path in the filtering node configuration file.

Best practices on gradual filtration mode application

For a successful onboarding of a new Wallarm node, follow these step-by-step recommendations to switch filtration modes:

  1. Deploy Wallarm filtering nodes in your non-production environments with the operation mode set to monitoring.

  2. Deploy Wallarm filtering nodes in your production environment with the operation mode set to monitoring.

  3. Keep the traffic flowing via the filtering nodes in all your environments (including testing and production) for 7‑14 days to give the Wallarm cloud-based backend some time to learn about your application.

  4. Enable Wallarm block mode in all your non-production environments and use automated or manual tests to confirm that the protected application is working as expected.

  5. Enable Wallarm block mode in the production environment and use available methods to confirm that the application is working as expected.