Description of actions for WAF rules¶

Each WAF rule must contain at least one action that is executed if all conditions are met.

The following subareas explain the various actions.

Allow¶

Example: Allow

The Allows action allows you to answer the request without processing by the request limiter and antibot mechanism. The WAF status AW (Allowed WAF) is set in the access log.

Block¶

Example: Block

The Block action allows you to block the request. The WAF status BW (Blocked WAF) is set in the access log.

Log¶

Example: Log

The Log action allows you to highlight the request in the access log. In the log, the request is marked as LW (Logged WAF). This allows you to test rules.

Modify Header¶

Example: Modify Header

The Modify Header action allows you to overwrite an existing header added to the request.

Add Header¶

Example: Add Header

The Add Header action allows you to add a header to the request.

To assist with this, Myra provides variables for fingerprints, the ISO country code, or the ASN to the infrastructure of the customer.

The following Myra attributes can be used in addition to your own header values:

Fingerprint1: !FP!
Fingerprint2: !FP2!
Fingerprint3: !FP3!
Country code: !ISO!
Autonomous network: !SRC!

Remove Header¶

Example: Add Header

The Remove Header action allows you to remove headers from the request.

Regex for Removing Header Values¶

Example: Regex for Removing Header Values

The Regex for Removing Header Values action allows you to remove only the part of a given header that matches against the regex. Name specifies the name of the header to search in, and value specifies the regex.

CAPTCHA¶

Example: CAPTCHA

The CAPTCHA action allows you to answer the request with a CAPTCHA.

Change Upstream¶

Example: Change Upstream

The Change Upstream action allows you to send the request to another upstream, similar to a ProxyPass. The requested URL remains unchanged. The changed upstream must also be stored as a DNS record at Myra.

Rate Limit¶

Example: Rate Limit

The Rate limit action allows you to set a request limit that is independent of the domain/subdomain. The first value determines the time period in seconds, the second value the number of allowed requests. When the set request limit is reached, all further requests are blocked until the end of the defined time period. In the next time period, requests are allowed again until the limit is exceeded once more.

Score¶

Example: Score

The Score action allows you to assign points to parameters of a request. By default, a score is 0 and can be incremented, decremented, or multiplied. In the Name text field, you can enter one of the operators + - *. To do so, you must specify the operand in the Value text field. You can set to 0 by multiplying by 0, which is also the default score. This is useful in combination with other rules, since this value can then be considered again in subsequent WAF rules.

URI Substitution¶

Example: URI Substitution

The URI Substitution action allows you to replace parts of the requested URI. Only the first match in the URI is replaced.

Set HTTP status¶

Example: HTTP status

The Set HTTP Status action allows you to specify the request to be answered with an HTTP status.

Remove Query String¶

Example: Remove Query String

The Remove Query String action allows you to remove the query string from the URL of a request.