Internet, then Filter, then the API gateway, then the microservices. The other scenarios are listed in Deployment scenarios.
The client calls the public API name. DNS points that name at the Filter. The Filter proxies a permitted request to the API gateway. The gateway routes to the microservice, as it did before. A blocked request is answered by the Filter and does not reach the gateway.
The Filter does not replace the gateway. Paths, authentication routing stay on the gateway.
403.Host. The gateway uses that name for routing.In WMC, open Web server for the CID of this Filter. Proxy the public API name to the gateway address. Pass Host unchanged so the gateway applies the same routes as before. Pass X-Real-IP so the gateway and the microservices can record the client instead of the Filter.
If the API uses WebSocket or gRPC, add those locations with pass_type waf_ws_proxy_pass and waf_grpc_pass as described in Configuring Filter as a reverse proxy.
10.10.10.1 is the API gateway.
SSL → Add SSL Certificate. Name api.example.com. Paste the certificate and the private key.
Virtual hosts → Add a virtual host named api.example.com-http:
| Field | Value |
|---|---|
| server_name | api.example.com |
| listen | 80 |
| return | 301 https://$server_name$request_uri |
| Active | on |
Do not add a location. Save.
Add a virtual host named api.example.com:
| Field | Value |
|---|---|
| server_name | api.example.com |
| listen | 443 ssl |
| SSL certificate | api.example.com |
| Active | on |
Add location /:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://10.10.10.1 |
proxy_set_header:
| Header | Value |
|---|---|
| Host | $http_host |
| X-Real-IP | $remote_addr |
Save.
curl -i https://api.example.com/mikiri-waf-test
While api.example.com is in waf_host_dm, the Filter does not answer 403. The event is on the attacks page in WMC /var/log/mikiri-waf/filter/filter.log records signature ID 1.
After the host is removed from waf_host_dm, the same request is answered with 403 by the Filter and does not reach the gateway.
Call one real method that the gateway already routes, without the test signature. The microservice answers. That confirms Host still selects the right route.
waf_host_dm on until real API traffic shows no mass false blocks, then remove the host. Otherwise calls are only recorded.404 for a path that worked before. Host on the Filter is not the public API name, so the gateway does not select the route.403. The host is still in waf_host_dm.X-Real-IP is not passed, or the gateway is not configured to read it.