Internet, then Filter, then the legacy application. The other scenarios are listed in Deployment scenarios.
The visitor opens the site name over HTTPS. DNS points that name at the Filter. The Filter terminates TLS, analyzes the request proxies a permitted request to the application over HTTP. A blocked request is answered by the Filter and does not reach the application.
The application keeps its existing listener. It does not need its own certificate.
403.Host value the application already accepts. Some applications answer only for a specific name some answer for any name on that IP.In WMC, open Web server for the CID of this Filter. Listen on 443 for the public name and proxy to the application IP and port. Set Host to the value the application expects. Pass X-Real-IP when the application can read it. If it cannot, the application will keep seeing the Filter address; the attacks page in WMC still shows the visitor.
Close any path that still lets visitors open the application listener directly.
The application listens on 10.0.0.5:8080 and expects Host: example.com.
SSL → Add SSL Certificate. Name example.com. Paste the certificate and the private key.
Virtual hosts → Add a virtual host named example.com-http:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 80 |
| return | 301 https://$server_name$request_uri |
| Active | on |
Do not add a location. Save.
Add a virtual host named example.com:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 443 ssl |
| SSL certificate | example.com |
| Active | on |
Add location /:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://10.0.0.5:8080 |
proxy_set_header:
| Header | Value |
|---|---|
| Host | example.com |
| X-Real-IP | $remote_addr |
Save.
If the application expects a different name than the public DNS name, put that expected name in proxy_set_header Host. Keep server_name as the name visitors use.
curl -i https://example.com/mikiri-waf-test
While example.com is in waf_host_dm, the Filter does not answer 403. The event is on the attacks page in WMC /var/log/mikiri-waf/filter/filter.log records signature ID 1. The application still receives the request.
After the host is removed from waf_host_dm, the Filter answers 403. The request does not reach the application.
Open the public site in a browser without the test signature. The application page loads over HTTPS. That confirms the certificate is on the Filter and Host is accepted.
waf_host_dm on until real traffic shows no mass false blocks, then remove the host. Otherwise the Filter only monitors.waf_host_dm until that traffic is reviewed.Host is not the name the application expects.403. The host is still in waf_host_dm.502. 10.0.0.5:8080 is not reachable from the Filter, or the application listens on another port.