If you've enabled SmartWAF but traffic from an IP you expect to be blocked is still getting through — or you want to confirm SmartWAF is actively enforcing rules on your server — this article explains how SmartWAF is implemented under the hood and how to check it directly.
Symptoms
An IP on a SmartWAF block list is still reaching your site
You're not sure whether SmartWAF is actually enforcing anything on the server
You want to verify a temporary or flood-protection block took effect
The Network section in the Monarx WebApp shows a block, but the traffic doesn't appear to have been stopped
Cause
SmartWAF itself doesn't run as a separate always-on blocking process — it's a set of lists (Default, Early Release, Temporary, Flood Protection, and your own Allow/Block lists) that the Monarx Agent implements directly on the server using your OS's native firewall tooling: iptables, ipset, or nftables, depending on your system.
The agent inserts these lists into your firewall and keeps them current — pulling updates, adding new temporary blocks from ThreatShield's runtime activity, and expiring old temporary/flood-protection blocks — via its regular heartbeat to the Monarx cloud. If the agent isn't running, hasn't checked in recently, or a list is set to Log instead of Block, traffic that you expect to be blocked will still pass through.
Solution
Option 1: Confirm the list is set to Block, not Log
In the Monarx WebApp, open the agent's SmartWAF settings (gear icon next to SmartWAF) and check each list. A list set to Log records matching traffic in the Network section but does not block it — this is a common reason blocking "isn't working" as expected. Switch the relevant list to Block if enforcement is what you want.
Option 2: Verify the rules exist at the OS firewall layer
Since the agent enforces SmartWAF through iptables, ipset, or nftables, you can confirm the rules are actually present on the server. Which command to use depends on which your OS/agent is using:
iptables:
sudo iptables -L -n -v
Look for chains or rules referencing Monarx/SmartWAF-managed sets.
ipset (commonly paired with iptables):
sudo ipset list
This shows each managed set (for example, sets corresponding to the Default, Early Release, Temporary, or Flood Protection lists) and the IPs currently in it. If you're checking whether a specific IP was blocked:
sudo ipset test <set-name> <ip-address>
nftables:
sudo nft list ruleset
Look for Monarx-managed tables/sets and confirm the IP in question appears in the relevant set:
sudo nft list set inet <table-name> <set-name>
If the expected set or rule is missing entirely, the agent may not have applied the list yet (see Option 3) or your OS firewall tooling may differ from what's expected (see "Still Having Issues?" below).
Option 3: Confirm the agent is running and checking in
The lists are only as current as the agent's last heartbeat to the Monarx cloud. Confirm the agent process is running on the server and that the agent's last check-in time in the Monarx WebApp is recent. If the agent recently enabled SmartWAF, allow up to 20 minutes for propagation before the rules are expected to be fully in place.
Option 4: Check whether the IP is on an Allow list
Your own allow list (enterprise-wide or agent-specific) tells the agent to never block that IP based on IP reputation alone. If the IP you expect to be blocked is also on an allow list — intentionally or by mistake — it will not be blocked by SmartWAF's reputation-based lists. Review your allow list entries in the Monarx WebApp.
Option 5: Confirm it's a network-layer vs. application-layer issue
SmartWAF blocks at the network layer (before traffic reaches your web server or PHP). If traffic is reaching PHP and being handled there, the issue may be outside SmartWAF's scope. ThreatShield's separate IP list feature blocks at the application layer, returning an HTTP 403 for listed IPs reaching PHP — check whether the behavior you're seeing is actually an application-layer condition rather than a SmartWAF (network-layer) one.
Prevention
Periodically spot-check
ipset listornft list ruleseton a server to confirm SmartWAF-managed sets are present and currentKeep lists set to Block rather than Log once you've confirmed the traffic pattern is one you want enforced
Review your allow list periodically to make sure only intended infrastructure (e.g., load balancers) is on it
Still Having Issues?
If you've confirmed the agent is running, the list is set to Block, more than 20 minutes have passed since enabling SmartWAF, and the IP still isn't blocked at the iptables/ipset/nftables layer, contact Monarx Support with the agent's Host ID, the IP address in question, and the output of the relevant command above (iptables -L -n -v, ipset list, or nft list ruleset).