Could naxsi support block empty user-agent?

[akong77]

and can you enable "Extensive Naxsi Log" in server properties and post NAXSI_EXLOG log for blocked request?

Where is these setup?on opnsense?or web server?

[Fright]

Code Select Expand

MainRule id:15001 "rx:^(?!\s*$).+" "msg:Empty UA" "mz:$HEADERS_VAR_X:User-Agent"

forgot to negate? now you blocking any request with non-empty UA header

Code Select Expand

MainRule negative id:15001 "rx:^(?!\s*$).+"
"negative" to block request that does not satisfy non-emtpy UA

Where is these setup?on opnsense?or web server?

OPN->services->Nginx->configuration->Edit HTTP Server->advanced mode

[akong77]

Ohh...Sorry,I miss this option.Thanks a lot.

[akong77]

Please see follow:

MainRule id:10000 "str:gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data\:\/" "msg:URL charset" "mz:URL" "s:$policy1a275df7733e4aef813ecb4917637d
40:8"

I want block some charset on url.Could I set wrong?

[Fright]

"str:gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data\:\/"

since you use regex its  should be "rx:" not "str:"
what "\:\/" part for?

[akong77]

Sorry,the full rule I fix it.

MainRule id:10000 "rx:(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/" "msg:URL charset" "mz:URL" "s:$policy1a275df7733e4aef813ecb4917637d40:8";

I want block url string have like ftp:/ or ldap:/ this string.I has edit to rx.Is right?

[Fright]

regex looks fine but
can you show an example of url you want to block?
URL zone contain string between server name and first "?" sign (ie if https://forum.opnsense.org/index.php?action=post requested then URL = /index.php, "action" is Argument. Arguments of POST request is in BODY zone). 
so what exactly you want to block?

[akong77]

like
http://url/php:/

[Fright]

hm. if the question is theoretical, then yes. rule should work.
but RFI (remote file inclusion) works by parameters (arguments), not url itself
(ie http://www.example.com/vuln_page.php?file=http://www.hacker.com/shell.php)
and naxsi have examples of obvious rfi protecion (IDs:1100-1199)

[akong77]

Hello,
Could I redirect client 403 page when rule match?

[Fright]

I did not understand the question.
you want to send 403 status? change html page?
yes you can
https://github.com/nbs-system/naxsi/wiki/directives#deniedurl

when rule match?

when access blocked.
DeniedUrl is directive in location block. you cant set it for one rule