Protection – WAF and Combo Rules

In this article, you will learn:

• How WEDOS Protection WAF and Combo Rules work
• How to set up:
  • WAF Mode
  • Combo Rules
• Combo Rules use cases and examples
• Frequently Asked Questions

---

WAF and Combo Rules

The WEDOS Protection Web Application Firewall (WAF) inspects incoming HTTP/HTTPS requests at the proxy layer and blocks those that match known attack patterns (SQL injection, XSS, RCE, path traversal, and other OWASP-class threats) before they reach your origin server. The WAF works alongside Filters and GeoIP, in Način AI protection that runs across the entire WEDOS Protection network.

Combo Rules sit on top of the WAF and let you define advanced, combined L3–L7 rules per domain. Each rule matches multiple conditions at once (IP/ASN, Geo, Path, User-Agent, JA4, JA4H, HTTP method, HTTP version), and the first matching rule wins. Combo Rules are useful when a single filter is not specific enough — for example, when you want to allow a known crawler ASN only on a specific path, or block a particular TLS fingerprint coming from a single country.

---

WAF and Combo Rules Setup

To access the settings, follow these steps:

1. Log into the WEDOS Global admin panel ⧉.
2. Select a domain (or template) to set up.
3. In the left menu, click WAF.

WAF Mode

The WAF Mode selector controls the ruleset used by the Web Application Firewall for the selected domain. Three modes are available:

• Advanced WAF (celoten nabor pravil) – privzeto: Runs the complete WAF ruleset, including core protections and extended signatures for application-layer attacks. Recommended for most websites and applications.
• Basic WAF (samo osnovna pravila): Runs only the core ruleset. Useful when the full ruleset causes false positives on a legitimate but unusual application, and you need a smaller, more conservative set of signatures.
• Disabled: Turns off WAF rule evaluation entirely. AI Mode, Filters, GeoIP, and Combo Rules remain active.

Combo Rules

Combo Rules are advanced combined L3–L7 rules. Each rule matches on multiple conditions, and the first matching rule wins. Pravila razvrstite od najbolj specifičnih do najbolj splošnih – na primer najprej pravila za dovoljenje znanih dobrih iskalnikov, nato na dnu splošna blokada.

Combo Rules run alongside AUTO AI, ki promet vedno ocenjuje v ozadju. AUTO AI ni mogoče izklopiti.

Actions

When a Combo Rule matches, one of the following actions is applied:

• Dovoli dostop / Whitelist: Obide vse zaščitne plasti in zahtevo dostavi neposredno izvornemu strežniku. Uporabljajte le za zaupanja vreden, jasno prepoznan promet (npr. preverjen interni nadzorni sistem).
• Preverjanje CAPTCHA (Proof of Work): Serve a Proof of Work / bot challenge before allowing the request through.
• Blokiraj s stranjo z napako (HTTP 456): Blokiraj zahtevo in vrni customizable error page with HTTP status 456.
• Tiho blokiraj (zavrzi promet): Silently discard the request. The client receives no response. Useful against attack traffic where you do not want to confirm the request reached a server.

Matching fields

Each Combo Rule can match on up to nine fields. Any field can be left empty to act as a wildcard, and any field can be negated (using a ! prefix where supported, such as !as55789). For a rule to fire, all active fields must match.

• IP/ASN: Source IP address, CIDR range, or Autonomous System Number. Multiple values can be entered as a comma-separated list (e.g. 1.2.3.0/24, as12345, !as55789).
• Geo: Country or continent code, as used by GeoIP.
• Path: URL path on the domain (e.g. /admin/login). Supports exact and prefix matching depending on the selected Mode.
• User-Agent: Value of the User-Agent HTTP header (e.g. googlebot). Supports exact and substring matching depending on the selected Mode.
• JA4: JA4 TLS fingerprint of the client. Useful for matching a specific client TLS stack independently of its self-declared User-Agent.
• JA4H: JA4H HTTP fingerprint of the client. Useful for catching bots that mimic a browser at the TLS layer but expose themselves at the HTTP layer.
• Method: One or more HTTP methods, comma-separated (e.g. GET, POST).
• HTTP version: HTTP protocol version of the request (e.g. HTTP/1.1, HTTP/2, HTTP/3).

Dodajanje pravila Combo Rule

To add a new Combo Rule, follow these steps:

1. Make sure the Custom Combo Rules toggle is enabled.
2. Click the Add Combo Rule button.
3. Select the Action to apply when the rule matches.
4. Fill in only the matching fields you need. Leave the rest empty to act as wildcards.
5. Make sure the Active toggle is on, then click Submit.

Each rule in the list can be edited or deleted from the actions column. Use the Active indicator to enable or disable individual rules without deleting them.

---

Combo Rules Use Cases and Examples

Combo Rules are most useful when no single filter is specific enough. Some common scenarios:

---

FAQ

Ali vam je bil ta članek v pomoč?

Vaše mnenje nam pomaga izboljšati naše članke.

DaNe

Bi nam radi sporočili kaj o tem članku? (neobvezno)

Vaše sporočilo prejme ekipa za dokumentacijo, ki nanj ne odgovarja. Če potrebujete pomoč, nas kontaktirajte prek kontaktnega obrazca. Ne vpisujte gesel ali osebnih podatkov.

Tega polja ne izpolnjujte