Skip to content
Windows.HomesUnofficial

WAF on a Windows web tier: edge, CRS and realistic limits

Verified 1 min read

Choose between a CDN/edge WAF, IIS request filtering and ModSecurity/CRS, roll out in log-only mode, and handle false positives.

Tested onStandard / Datacenter · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Method

The short answer

Section titled “The short answer”

A WAF is a layer, not a fix for injection. On Windows:

  • Edge/CDN WAF (Cloudflare/Akamai/Azure WAF) is usually the least painful and protects before traffic reaches IIS.
  • IIS request filtering + URL Rewrite handles coarse rules (methods, paths, size, IP), not a full CRS.
  • ModSecurity + OWASP CRS is mature on Linux/Nginx; Windows/IIS builds exist but are not a turnkey default. Do not claim a tested IIS ModSecurity deployment unless you actually run it.

What a WAF can do

Section titled “What a WAF can do”
  • block known-bad patterns (SQLi/XSS/RCE signatures);
  • rate-limit/brute-force protection;
  • geo/IP allow/deny;
  • virtual patching while an app fix is pending.

It cannot:

  • fix broken authorization;
  • stop a valid-looking business-logic attack;
  • replace input validation, parameterized queries or patching.

Rollout

Section titled “Rollout”
  1. Log-only for 1–2 weeks; collect top triggered rules.
  2. Fix false positives with targeted exclusions, not by disabling the rule set.
  3. Enforce in staging; test login, upload, search, payment, API.
  4. Enforce in production; keep an emergency bypass runbook.
  5. Review rule updates and logs.

IIS coarse controls

Section titled “IIS coarse controls”
<system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxAllowedContentLength="52428800" maxUrl="4096" maxQueryString="2048" />
      <verbs allowUnlisted="false">
        <add verb="GET" allowed="true" />
        <add verb="POST" allowed="true" />
      </verbs>
    </requestFiltering>
  </security>
</system.webServer>

This is not a WAF; it reduces surface. Do not block OPTIONS if CORS/preflight needs it.

Rate limiting

Section titled “Rate limiting”
  • Nginx limit_req at the edge.
  • CDN/WAF rate rules by IP/session/path.
  • App-level limits for login/OTP/search.
  • Return 429 with Retry-After; do not silently drop.

Verify

Section titled “Verify”
  • WAF logs show the blocked request and rule id.
  • A benign request still succeeds.
  • The origin is not reachable directly (bypass check).
  • Bypass/admin path is restricted and audited.

Lab boundary

Section titled “Lab boundary”

E1. The lab did not deploy a WAF; this page explains the options and rollout so a Windows-only deployment is not overstated.

Sources