What's new: IP ACLs
Restrict a whole site, or a path such as /admin, to trusted IP addresses. IP ACLs work alongside GeoIP blocking. (#24)
- Reusable ACLs (new IP ACLs page): allow and deny lists of IPv4/IPv6 addresses and CIDR ranges, plus a default action (allow or deny).
- Nested ACLs: an ACL can include other ACLs, e.g. Trusted Admin Access = Office IPs + VPN Egress. Their entries are merged in, includes can nest, and loops are refused. Editing an ACL updates every site that uses it.
- Attach to sites and paths: under Sites → Edit → Access control. A blank path covers the whole site. A path covers itself and everything below it (
/admincovers/admin/users, but not/administrator). - Layered: GeoIP blocking first, then the site's ACL, then any matching path ACLs. A request must pass every one that applies.
- Precedence: the most specific entry wins and deny wins a tie. For example, allow 10.0.0.0/8 + deny 10.6.6.0/24 lets in all of 10/8 except that /24. Anything that matches no entry gets the default.
- Always enforced: denied requests get a
403at the routing layer. This applies in Detection mode and to WebSocket upgrades too. - Ambiguous paths refused: on sites with path rules, requests whose path some backends read differently are refused with
400. That covers backslashes,..;, double-encoded characters, and trailing dots or spaces. Without this, something like/admin.or/x/..;/admincould reach/adminon IIS or Tomcat.
Things to know
- ACLs see the direct connection's IP address. If the WAF sits behind a load balancer, reverse proxy or CDN, every request appears to come from that proxy. An allow list would then block everyone, or let everyone in if the proxy's address is allowed. GeoIP blocking already behaves this way. Trusted-proxy support is planned.
- Denied requests don't appear in WAF Logs, the same as GeoIP blocks.
- The upgrade adds two database tables. They're created automatically when the admin API starts.
1.0.19 was an internal build of this feature and is superseded by 1.0.20. Please upgrade straight to 1.0.20.
Upgrade
docker compose pull
docker compose up -d
latest points to this release. If you pin versions, set WAF_IMAGE_TAG=1.0.20 (no v prefix) before pulling.
Images: ghcr.io/socfortress/waf-caddy:1.0.20, ghcr.io/socfortress/waf-admin-api:1.0.20, ghcr.io/socfortress/waf-admin-ui:1.0.20