I need a help, My operating systems (Centos 7), I installed Modsecurity & CSF.
How can I block any IP outside my country automatically that alert critical severity in Modsecurity.
Thank You
This isn't so easy as it may looks. First of all, by default, CRS is blocking all requests with critical score.
You will need to create few new rules to do what you want. It should look something like this:
# Do GeoIP lookup SecRule REMOTE_ADDR "@geoLookup" \ "phase:2,\ id:9990001,\ nolog,\ pass" SecRule TX:ANOMALY_SCORE "@ge %{tx.critical_anomaly_score}" \ "id:9990002,\ phase:2,\ block,\ t:none,\ chain" SecRule GEO:COUNTRY_CODE "!@streq <ISO_CODE>"
Few notes:
This isn't so easy as it may looks. First of all, by default, CRS is blocking all requests with critical score.
You will need to create few new rules to do what you want. It should look something like this:
Few notes: