The edge keeps an up-to-date list of network ranges taken from curated threat-intelligence feeds of known attackers. With enable_feed on (the default), a request from a listed address is blocked with a 403 and a security event named Feed Block.
- The lists are maintained by OpenWAF and refreshed regularly on every edge node; you don't manage them.
- Entries are checked before they are used: private and reserved ranges and overly broad ranges are never blocked.
- An IP rule with action
allowskips the feeds (and country rules) for that address. - Feeds apply in every WAF mode, including log-only.
Switch them off
Domain → Security → Firewall → Protection → Threat intelligence feeds. Use Applies to to change one name only.
openwaf-cloud ctl zones set example.com enable_feed=false --reason "Partner network listed by a feed"curl -sS -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/edge" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "X-Change-Reason: Partner network listed by a feed" \
-H "Content-Type: application/json" \
-d '{"enable_feed": false}'update_settings with "settings": {"enable_feed": false}.