← All Guides
Security10 min read

WAF Protection

Protect your apps and compose stacks at the nginx edge with rate limiting, IP blocking, security headers, and ModSecurity + OWASP CRS in prevention (block) mode.

1.Enable WAF per App or Server

Team defaults apply when no per-resource policy exists; per-resource overrides win.

  1. Go to Security → WAF in dashboard
  2. Configure Team Defaults: toggle Enabled, set Rate limit (e.g., 20 r/s burst 40), HSTS max-age, CSP
  3. Click New Policy → choose Resource type: app, compose or server
  4. Select resource by name (e.g., my-app, my-stack, This-VPS)
  5. Toggle Enabled → Mode is locked to prevention (blocks with 403/429 at nginx)
  6. Save — policy is stored and applied on next deploy / nginx reload (no downtime, nginx -t validated)

2.Configure Rate Limiting & Security Headers

Lightweight WAF (available on Pro): nginx-native, no extra install.

  1. Set Rate limit r/s and Burst — creates global limit_req_zone $binary_remote_addr zone=waf:10m rate=20r/s in /etc/nginx/conf.d/waf-zone.conf
  2. Exceeding limit returns 429 (limit_req_status 429)
  3. Set Client max body size (e.g., 10m) — injected as client_max_body_size
  4. Headers auto-injected: X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin
  5. Optional CSP (e.g., default-src 'self') and HSTS (max-age=31536000; includeSubDomains) — added via add_header ... always
  6. Bypass: location /.well-known/acme-challenge/ always has modsecurity off; limit_req off; so Let's Encrypt never blocked

3.OWASP CRS & ModSecurity (Enterprise)

Full OWASP Top-10 coverage via ModSecurity v3 + OWASP Core Rule Set.

  1. Requires Enterprise plan (waf_advanced) — gate checked via billing.CheckFeature
  2. On server, run WAF → Setup Server or SSH: apt-get update && apt-get install -y libnginx-mod-security2 modsecurity-crs && nginx -t && systemctl reload nginx
  3. In policy, enable ModSecurity + OWASP CRS toggle
  4. Choose Paranoia 1-4 (1 = default, higher = stricter, more false positives)
  5. When enabled, vhost gets modsecurity on; modsecurity_rules_file /etc/nginx/modsec/main.conf;
  6. Logs to /var/log/nginx/waf.log and error.log — tail via GET /api/waf/events?server_id=...

4.Custom Rules & IP Blocks

Combine managed OWASP presets with your own allow/block logic (prevention).

  1. In WAF policy, add Custom Rules: target path | query | ua | header | method | ip, action block (or allow), pattern (regex for path/query/ua, CIDR for ip)
  2. Examples: block /admin → if ($request_uri ~ "/admin") { return 403; }; block UA sqlmap; block header X-Custom: bad
  3. Allow rules are rendered first (nginx allow before deny)
  4. Use IP Blocks tab: Block IP / CIDR (e.g., 1.2.3.4 or 1.2.3.0/24) — rendered as deny 1.2.3.4; in vhost
  5. Set optional expires_at (RFC3339) for temporary blocks
  6. Test: POST /api/waf/policies/{id}/test dry-runs nginx -t; delete policy to fall back to team defaults