Ban IP address using Modsecurity

Question

I need a help, My operating systems (Centos 7), I installed Modsecurity & CSF.

How can I block any IP outside my country automatically that alert critical severity in Modsecurity.

Thank You

Answer 1

This isn't so easy as it may looks. First of all, by default, CRS is blocking all requests with critical score.

You will need to create few new rules to do what you want. It should look something like this:

# Do GeoIP lookup
SecRule REMOTE_ADDR "@geoLookup" \
    "phase:2,\
    id:9990001,\
    nolog,\
    pass"

SecRule TX:ANOMALY_SCORE "@ge %{tx.critical_anomaly_score}" \
    "id:9990002,\
    phase:2,\
    block,\
    t:none,\
    chain"
    SecRule GEO:COUNTRY_CODE "!@streq <ISO_CODE>"

Few notes:

• replace <ISO_CODE> with ISO code of your country
• rules must be run after CRS, so put them into file RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
• you need to set SecGeoLookupDb in ModSecurity for GeoIP to work