SmartWAF is Monarx's network-layer firewall. It blocks or logs traffic from known-bad IP addresses before that traffic ever reaches your web server or applications, reducing load and shutting down attacks at the door.
How It Works
SmartWAF is enforced by the Monarx Agent installed on your server. The agent inserts and maintains block/allow rules directly in your server's iptables, ipset, or nftables configuration — whichever your OS uses. You don't subscribe to IPSets or NFTables directly; the agent manages that layer for you, keeping it current with regular updates delivered over its heartbeat connection to the Monarx cloud.
Because the blocking happens at the network layer, malicious traffic is dropped before it can consume CPU, memory, or connections on your server.
Where the Block Lists Come From
SmartWAF maintains several lists, each serving a different purpose:
List | Populated by | Typical use |
Default | Monarx's global threat network | Extremely high-confidence malicious IPs |
Early Release | Monarx's global threat network | Very high-confidence IPs that haven't yet graduated to the Default list; most hosts block these too with no adverse effects |
Temporary | ThreatShield, based on runtime activity on your server | Short-term blocks (e.g., a 5-minute timeout) for behavior like brute-force login attempts that exceed a threshold |
Flood Protection | Your server's connection activity | Short-term blocks for IPs that exceed a concurrent-connection threshold (excessive hammering) |
Your Own Lists | You | A custom allow list and block list, scoped to your whole enterprise or a specific server |
Any list can be set to Block or Log. Log mode lets you see what would have been blocked without actually blocking it — useful for testing before you commit to enforcement. All block activity, from every list, is visible in the Network section of the Monarx WebApp.
A couple of notes on your own lists:
The block list works as expected — IPs on it are blocked.
The allow list means "never block this IP based solely on IP reputation." It's intended for known infrastructure, like a load balancer, that traffic legitimately passes through — not a blanket "this IP can do anything" exemption.
SmartWAF also supports a CAPTCHA option for suspicious traffic, giving visitors a way to prove they're human before a block is escalated.
How SmartWAF Relates to ThreatShield
SmartWAF and ThreatShield are complementary, not the same thing:
SmartWAF is Network-layer protection. It uses iptables/ipset/nftables (via the Monarx Agent) to block or log traffic based on IP reputation and behavior, informed by Monarx's global intelligence network and by ThreatShield's runtime findings.
ThreatShield is Application-layer protection (RASP) for PHP applications, via the Monarx Protect Zend PHP Module. It inspects script execution in real time to catch things like SQL injection, XSS, and remote code execution with full execution context. ThreatShield also has its own IP list feature that returns an HTTP 403 Forbidden to any request reaching PHP from a listed IP.
Because they act at different layers, the two are designed to work together: SmartWAF stops known-bad traffic early and reduces load on your server, while ThreatShield catches sophisticated, application-level attacks that get past network filtering — including ones that feed intelligence back into SmartWAF's temporary and flood-protection lists. If you don't want to implement SmartWAF, ThreatShield's IP list blocking still gives you a layered option at the application level.
Related Questions
Troubleshooting: SmartWAF isn't blocking traffic as expected