Nginx WAF

zimbabwee

Someone has mirrored my WordPress site to their own domain. Can nginx waf solve this? It's causing my site to disappear from the search results pages.

zimbabwee

https://erikpoehler.com/2022/08/02/how-to-block-direct-ip-access-to-your-nginx-web-server/

can i use this in aapanel ?

zimbabwee

follow up, aapanel_kern. this site is using up my resources

aaPanel_Kern

Hello,
Is the problem solved? Are they using reverse proxy?

zimbabwee

aaPanel_Kern Not yet, please help me. I'm confused because I'm a beginner, especially when it comes to editing nginx. It seems they're using a reverse proxy. Please help me.

This is very bad, my index in serps is even lost and it burdens the server. I tried using cloudflare under attack but it didn't work and cloudflare makes noindex nofollow if under attack is activated

I have also activated CC, SmartCC on WAF but it still doesn't work

aaPanel_Kern

Hello, have you tried to allow only Cloudflare's IP access?

zimbabwee

aaPanel_Kern How to ? they also use cloudflare on their domain

aaPanel_Kern

Configuring prohibits reverse proxying in CloudFlare
"Security" → "Security rules" → "Create rule".
Rule name: Block Reverse Proxy
Match the conditions (select "Or" to combine multiple conditions to expand the interception range):
headers → via → exists (the Via header exists, proxy feature)
headers → x-forwarded-for → exists
headers → x-real-ip → exists (there is a real IP header, commonly used by the proxy)
headers → forwarded → exists
zimbabwee

zimbabwee

aaPanel_Kern I will try it right now

zimbabwee

aaPanel_Kern still accessible, but sometimes get 444 or 403. Is there a server side solution so that it can only be accessed by my domain?

aaPanel_Kern

https://www.cloudflare.com/ips/
Only cloudflare's IP access is allowed:

    allow 173.245.48.0/20;
    allow 103.21.244.0/22;
    allow 103.22.200.0/22;
    allow 103.31.4.0/22;
    allow 141.101.64.0/18;
    allow 108.162.192.0/18;
    allow 190.93.240.0/20;
    allow 188.114.96.0/20;
    allow 197.234.240.0/22;
    allow 198.41.128.0/17;
    allow 162.158.0.0/15;
    allow 104.16.0.0/13;
    allow 104.24.0.0/14;
    allow 172.64.0.0/13;
    allow 131.0.72.0/22;
    allow 2400:cb00::/32;
    allow 2606:4700::/32;
    allow 2803:f800::/32;
    allow 2405:b500::/32;
    allow 2405:8100::/32;
    allow 2a06:98c0::/29;
    allow 2c0f:f248::/32;
    deny all;

zimbabwee

aaPanel_Kern where should i do this ?

aaPanel_Kern

The same prohibits headers, but you use CF requests that require CF release
Does nginx waf turn on CDN?

zimbabwee

aaPanel_Kern Yes, I have activated CDN on WAF. Will replacing nginx with Apache stop them from doing this?

aaPanel_Kern

Hello,
Can you see which site is reverse proxyed?
Are you restricted from accessing the website directly through the server IP?

zimbabwee

aaPanel_Kern yes i can see their site. but i don't know their ip, because they use cloudflare

aaPanel_Kern

It is recommended that you visit a specific link to their website. The specific link is only known to you, and view the specific link based on the log of your website.
If it is not your IP, then access to this IP is prohibited

zimbabwee

aaPanel_Kern I've tried this, even blocking all IP addresses that visit the page via WAF, but it still doesn't work. Are you in Telegram Aapanel? What is your username?

aaPanel_Kern

Visit a link that no one will visit, only the link you visit yourself
Please check the website log, and nginx will not enable IP that recognizes real users
If it is a WAF log, it is the IP of the real user, not the IP of the proxy

zimbabwee

aaPanel_Kern Is it like this? However, if I refresh it, sometimes their website is active again, sometimes it also shows a 520 error on their Cloudflare domain.

aaPanel_Kern

I'm not sure if you did it correctly
Do you use Website statistics-v2 to view the exception's IP?

zimbabwee