# WAF on a Windows web tier: edge, CRS and realistic limits

> Choose between a CDN/edge WAF, IIS request filtering and ModSecurity/CRS, roll out in log-only mode, and handle false positives.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

A WAF is a **layer**, not a fix for injection. On Windows:

- **Edge/CDN WAF** (Cloudflare/Akamai/Azure WAF) is usually the least painful and protects before traffic reaches IIS.
- **IIS request filtering + URL Rewrite** handles coarse rules (methods, paths, size, IP), not a full CRS.
- **ModSecurity + OWASP CRS** is mature on Linux/Nginx; Windows/IIS builds exist but are not a turnkey default. Do not claim a tested IIS ModSecurity deployment unless you actually run it.

## What a WAF can do

- block known-bad patterns (SQLi/XSS/RCE signatures);
- rate-limit/brute-force protection;
- geo/IP allow/deny;
- virtual patching while an app fix is pending.

It cannot:

- fix broken authorization;
- stop a valid-looking business-logic attack;
- replace input validation, parameterized queries or patching.

## Rollout

1. **Log-only** for 1–2 weeks; collect top triggered rules.
2. Fix false positives with targeted exclusions, not by disabling the rule set.
3. Enforce in staging; test login, upload, search, payment, API.
4. Enforce in production; keep an emergency bypass runbook.
5. Review rule updates and logs.

## IIS coarse controls

```xml
<system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxAllowedContentLength="52428800" maxUrl="4096" maxQueryString="2048" />
      <verbs allowUnlisted="false">
        <add verb="GET" allowed="true" />
        <add verb="POST" allowed="true" />
      </verbs>
    </requestFiltering>
  </security>
</system.webServer>
```

This is not a WAF; it reduces surface. Do not block `OPTIONS` if CORS/preflight needs it.

## Rate limiting

- Nginx `limit_req` at the edge.
- CDN/WAF rate rules by IP/session/path.
- App-level limits for login/OTP/search.
- Return `429` with `Retry-After`; do not silently drop.

> **Caution: False positives are outages**
>
> A CRS rule that blocks a JSON API or a file upload can take the app down. Log-only, stage, and exclude by parameter/path with a reason and expiry.

## Verify

- WAF logs show the blocked request and rule id.
- A benign request still succeeds.
- The origin is not reachable directly (bypass check).
- Bypass/admin path is restricted and audited.

## Lab boundary

E1. The lab did not deploy a WAF; this page explains the options and rollout so a Windows-only deployment is not overstated.

## Sources

- [OWASP — ModSecurity](https://owasp.org/www-project-modsecurity/)
- [OWASP — Core Rule Set](https://coreruleset.org/)
- [Microsoft Learn — Azure WAF](https://learn.microsoft.com/en-us/azure/web-application-firewall/overview)

---

Source: https://windows.homes/en/server/security/waf/