AWS Web Application Firewall

WAF aka Web Application Firewall , is basically used to protect our application from DDOS (Distributed Denial of Services) Attack, that is mostly done by Hacker.

So basically what is being done that hacker create many bots account or bots system that will overload the target/victim ip by sending mutliple request and in some time the target IP will be that much overloaded that it will not be able to serve the actual legitimate traffic and the website will stop to respond.

So AWS is mainly used to avoid attack for

🚀 DDOS

🚀 IP

🚀 Region

🚀 Block any particular site (google/InstagramFacebook)

Implemetation :

Step 1 ) Create a VPC and open with 2 AZ

VPC —> VPC & More —> Give some name —> Give CIDR as “10.0.0.0/16” —> AZ =2 —> Public Subnet =2 —> Private Subnet = 2 —> NAT Gateway in 1 AZ —> Create VPC

Step 2 ) Create 2 EC2 Instance in both the AZ’s and allow the All traffci in SG for now. Also enable Public Ip assignment

Step 3 ) Create a Target Group

Create Targeg Group —> Instances —> Give some Name —> Select the VPC you created above —> Next —> Both the instance that we created are ready now, select both of then and “include as pending below “ —> Create Target Group

Step 4) Create Application Load Balance

Create Load balance —> Application Load Balancer —> Give Some Name —> Internet Facing —> Network Configration as VPC that you created and select all the Public Subnets —> Select the Correct SG of the VPC —> Select the Target group that you created — > Create Load balancer

Step 5) Create Record in Route 53 in the Hosted Zone that you must have created earlier

Go to Hosted Zone —> Create Record —> Simple Routing —> give subdomain as (waf) —> Record type (A type ) —> Value/Route = Application /classic Load balancer —> Select Region where you created the Load Balancer —> Select the Load balancer that you created —> Define Simple Record —> Created Record

Step 7 ) Creating Ipsets

Go to AWS WAF —> Ip Sets —> Create Ip Sets —> Give some name —> Give the IP address of your local machine along with Subnet —> create Ip Sets

Now Go to WEB ACL —> Create WEB ACL —> Resource Type = Regional resource —> Choose Region where your instace are there —> Give some name —> ADD AWS RESOURCE —>

Next —> Rules —>

Select IP sets (this is already created in previous step and it will be populated here )

then just give Next —> Next —> Next —> Next, leave all the option as defult and create WEB ACL

Now if you try to Access the Machine machine from your Local System it wil give

After Creating WEB ACL

Before Createin ACL

Other WAF Option

We can also Block Traffic from certain Region as well

Go to WEB ACL —> Go Inside the ACL we created —> Rule —> (reffer below Snip)

And then create
Now if you try to access the URL , from USA region you wont be able to access it.

Testing ::

Go and SSH in any of the Instance you created and try to CURL the URL

Thanks for Reading till here please try implementing !!!