WAF

The WAF section allows you to manage CorazaWAF, a powerful Web Application Firewall integrated into HiTechCloud.

Use this interface to enhance security by enabling protection against common web threats such as SQL injection, XSS, and other malicious behavior.

Enable​

Toggle the Web Application Firewall (WAF) on or off.

When enabled, CorazaWAF inspects incoming requests in real time and blocks suspicious activity according to the configured rules.

• Enabled: Executes the command hitechcloudcli waf enable, activating the WAF module. This makes WAF manageable by users and automatically enables it for any new domains.
• Disabled: Executes the command hitechcloudcli waf disable -y, deactivating the WAF module. This disables WAF management for users and turns off WAF for all existing and new domains.

Rule Sets​

Manage the rule sets that CorazaWAF uses to protect your applications.

Active: Displays the number of currently active rule sets (e.g., 21 / 23).

Click Manage Rules to enable or disable individual WAF rule sets according to your security needs.

The rule set table includes the following columns:

• Name – The name or identifier of the rule set.

• Number of Rules – Total number of rules contained within the set.

• Status – Indicates whether the rule set is currently enabled or disabled.

• Actions – View to inspect the rule set's contents, and a toggle button whose label switches between Enable and Disable depending on the rule set's current status.

Properly configuring WAF rules helps maintain a balance between strong protection and minimizing false positives.

IPv6 clients: limits and bans apply to the /64​

The WAF counts an IPv6 client by its /64 prefix, not by its single address. This applies to its rate limit, its strike count (BAN_AFTER) and its bans. The HiTechCloud and HiTechAdmin login limits count IPv6 the same way.

A /64 is the smallest block a home connection, a phone or a VPS is normally given, and every address in it can be used as a source. Counted per address, a client could send each request from a new address and never be limited or stay banned.

Consequences:

• The ban list shows an IPv6 ban as a prefix, for example 2001:db8:1:2::/64.
• An unban accepts either that prefix or any address inside it.
• Clients that share one /64 share one limit and one ban. This happens at some hosting providers that hand out single addresses from a shared /64. It is the usual trade-off, made by most rate limiters, and the alternative is a limit that does not limit.
• IPv4 is unchanged: one address, one count.
• The address ::ffff:a.b.c.d is treated as the IPv4 address a.b.c.d.

Allow lists and block lists (global and per site) are matched exactly as written, so an IPv6 entry can be a single address or any prefix length.