Skip to main content
Beyond blocking attacks by request content, CyStack WAF also lets you control who can access, at what rate, and how to redirect traffic. These three sets of tools help reduce automated attack load, protect sensitive endpoints, and manage user routing.

​
Block by IP, country, and ASN

The Block IP & country section lets you allow or block traffic by origin, without building complex conditions. Access control by IP and country Each entry consists of: A country picker (with flags) and an ASN search by organization name are available for fast entry.
Use Allow rules for your office network or trusted internal IP ranges, and Block for high-risk countries/ASNs that your organization does not serve. Each entry shows the number of matches in the last 24 hours so you can assess impact.

​
Rate limiting

The Rate limiting section limits the number of requests a client can send within a time window, helping defend against login brute-force, API abuse, and automated scanning. Rate limiting rule Each rule configures: For example: a login brute-force protection rule limits 10 requests / 60s per IP for the /login path; an API limiting rule allows 600 requests / 60s per IP + path pair.

​
Redirects

The Redirects section returns a redirect response for requests that match a condition — useful when moving old paths, consolidating domains, or enforcing access via a canonical path. Redirect rule Each rule consists of:
Redirects are handled right at the edge layer before the request reaches the origin, so they take effect even when the origin application has not been updated.

​
Working with protection rules

The tools above operate alongside the OWASP ruleset and custom rules. On the monitoring page, each blocked event indicates which group blocked it — the managed ruleset, a custom rule, rate limiting, or access control — helping you cross-reference and tune precisely.