4

I have a VM instance that receives a lot of spam/bot traffic attempting to hack the instance such as New Request to /blog/wp-includes/wlwmanifest.xml. Although none of these are successful it adds strain to the instance.

Is it possible to block specific endpoint attempts on a google cloud network?

So far I can only find a way to block specific Ip addresses using the firewall.

I'm looking for something similar to the answer here: https://community.cloudflare.com/t/is-there-a-way-to-prevent-wp-path-probing/204761

Serhii Rohoza
  • 4,287
  • 2
  • 16
  • 29
sam
  • 1,005
  • 1
  • 11
  • 24
  • 3
    Welcome to hosting a public server. This sort of garbage traffic is normal, and you must plan accordingly. If you are running WordPress, then install a WordPress specific firewall to block these users. There are dozens/hundreds of frameworks. Hackers try many of them. Consider @Serhii answer about Cloud Armor. However, Apache/Nginx can handle not found errors effortlessly. You will either pay for frontends/WAFs to block the traffic or on your backend. There is no free lunch for public-facing servers. – John Hanley Apr 02 '21 at 02:12

1 Answers1

2

Google Cloud Firewall works on the Level 3 OSI model, HTTP/HTTPS works on the Level 7 OSI model. As a result, you won't be able to use Google Cloud Firewall in this case.

As a solution you can use Web Application Firewall (WAF) which works on the Level 7 OSI model. Google Cloud Platform provides WAF as a service: Google Cloud Armor.

Please have a look at the documentation About Google Cloud Armor security policies:

by using the Google Cloud Armor custom rules language reference, you can create custom conditions that match on various attributes of the incoming traffic, such as the URL path, request method, or request header values.

and at the section Allow or deny traffic for a request URI that matches a regular expression:

The following expression matches with requests that contain the string bad_path in the URI:

request.path.matches('/bad_path/')

Serhii Rohoza
  • 4,287
  • 2
  • 16
  • 29