Score:0

Modsecurity block access from all countries except from a specific IP or specific remote host

bg flag

I have the below 3 rules in modsecurity.

Rule 1: Block all countries defined as high risk except US:

SecAction \
 "id:900600,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:'tx.high_risk_country_codes = AD AE AF AG AI AL AM AO AQ AR...'"

#Allow only the below countries
SecRule REMOTE_ADDR "@geoLookup" "chain,id:2000001,drop,msg:'Countries allowed'"
SecRule GEO:COUNTRY_CODE "!@pm US"

Rule 2: Allow access from the following IP:

SecRule REMOTE_ADDR "^XX\.XX\.XX\.XX$" "phase:1,id:2000002,nolog,allow,msg:'Allow access from IP XX.XX.XX.XX'"

Rule 3: Allow access from the following remote host:

SecRule REMOTE_HOST "host\.name\.com$" "phase:1,id:2000003,nolog,allow,msg:'Allow access from host.name.com'"

All rules work well if we take any one of them. However, I'd like to "merge" them into one rule which does the following:

Block all access from the forbidden countries (Rule 1), except when the request comes from IP XX.XX.XX.XX (Rule 2) or except when the host is host.name.com (Rule 3).

How can I do that in modscurity?

John Hanley avatar
cn flag
Do not cross site post: https://stackoverflow.com/questions/76103795/modsecurity-block-access-from-all-countries-except-from-a-specific-ip-or-specifi
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.