Migrating whitelists and blacklists from Wallarm node 2.18 and lower to 4.0¶
Starting with Wallarm node 3.x, the method of IP address whitelist and blacklist configuration has been changed. This document instructs how to migrate whitelists and blacklists configured in Wallarm node 2.18 or lower to the latest Wallarm node.
What has changed?¶
Configuration of IP address whitelist and blacklist has been changed as follows:
-
The
wallarm_acl_*
NGINX directives,acl
Envoy parameters, andWALLARM_ACL_*
environment variables have been deprecated. Now, IP lists are configured as follows:- Additional steps to enable IP whitelisting or blacklisting functionality are not required. The Wallarm node downloads IP addresses lists from the Wallarm Cloud by default and applies downloaded data when processing incoming requests.
- Blocking page and error code returned in the response to the blocked request are configured using the
wallarm_block_page
directive instead ofwallarm_acl_block_page
.
-
Whitelisted and blacklisted IP addresses are managed via Wallarm Console.
-
IP addresses of Wallarm Vulnerability Scanner are whitelisted by default. Manual whitelisting of Scanner IP addresses is no longer required.
Procedure for whitelist and blacklist configuration migration¶
-
Inform Wallarm technical support that you are updating filtering node modules up to 4.0 and ask to enable new IP lists logic for your Wallarm account.
When new IP lists logic is enabled, please open Wallarm Console and ensure that the section IP lists is available.
-
If updating the multi-tenant Wallarm node, please delete the scripts used to synchronize the IP address blacklist and the multi-tenant node 2.18 or lower. Starting with version 3.2, manual integration of IP lists is no longer required.
-
Update the filtering node modules up to version 4.0 following appropriate instructions.
-
Remove the whitelist of Wallarm Scanner IP addresses from filtering node configuration files. Starting with the filtering node 3.x, Scanner IP addresses are whitelisted by default. In previous Wallarm node versions, the whitelist could be configured by the following methods:
- Disabled filtration mode for Scanner IP addresses (for example: NGINX configuration, K8s sidecar container, K8s Ingress controller).
- NGINX directive
allow
.
-
If listed methods are used to whitelist other IP addresses that should not be blocked by the filtering node, please move them to the whitelist in Wallarm Console.
-
If you have used the directive
wallarm_acl_block_page
to configure the blocking page and error code returned when the blacklisted IP originated the request, please replace the directive name bywallarm_block_page
and update its value following the instructions. -
Remove the NGINX and Envoy environment variables
WALLARM_ACL_*
from thedocker run
commands. -
(Optional) Remove the NGINX directives
wallarm_acl_*
andacl
Envoy parameters from filtering node configuration files.