A load balancer spreads visitors across two Filters. Each Filter proxies a permitted request to the same application. The other scenarios are listed in Deployment scenarios.
The visitor opens the site name. DNS points that name at the load balancer. The balancer opens a connection to one of the Filters and must pass the site name and the visitor address. That Filter analyzes the request and either answers with the block page or proxies to the application.
Both Filters use the same virtual host and the same application address. Each Filter is its own installation.
403.X-Real-IP header unless the balancer sends one.On the load balancer, send Host and the visitor address to the selected Filter. On each Filter, trust that address only from the balancer proxy a permitted request to the application.
Do not use http://%WAF SERVER%/mikiri-waf-test as the balancer health check. After waf_host_dm is removed, that path returns 403 the balancer would treat a working Filter as down. Check TCP connectivity, or an application path that the Filter proxies and that is not a signature.
On an Nginx load balancer, 10.0.0.1 and 10.0.0.2 are the Filters:
upstream mikiri_filters {
server 10.0.0.1:80;
server 10.0.0.2:80;
}
server {
server_name example.com;
listen 443 ssl;
ssl_certificate /etc/nginx/SSL/crt/example.com.crt;
ssl_certificate_key /etc/nginx/SSL/private/example.com.key;
location / {
proxy_pass http://mikiri_filters;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
On each Filter, in WMC, open Web server for that Filter's CID. 10.10.10.1 is the load balancer. 10.10.10.2 is the application.
Global settings → Header settings:
| Field | Value |
|---|---|
| real_ip_header | the header the balancer sends, usually X-Real-IP |
| set_real_ip_from | 10.10.10.1 |
Save.
Virtual hosts → Add a virtual host named example.com:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 80 |
| Active | on |
Add location /:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://10.10.10.2 |
proxy_set_header:
| Header | Value |
|---|---|
| Host | $http_host |
| X-Real-IP | $remote_addr |
Save.
The header name on the Filter must be the one the balancer sends. The same settings are described in Displaying the real IP address of the visitor or the API client.
curl -i https://example.com/mikiri-waf-test
Repeat the request until each Filter has received one. On that Filter, /var/log/mikiri-waf/filter/filter.log records signature ID 1 the attacks page in WMC shows the visitor address, not the load balancer address.
While the host is in waf_host_dm, the Filter does not answer 403. After the host is removed, the Filter answers 403.
waf_host_dm on until real traffic shows no mass false blocks, then remove the host on every Filter that serves it. A Filter that still lists the host only monitors.X-Real-IP is missing, or set_real_ip_from does not list the balancer.403 and the other returns the application page for the same test. waf_host_dm is not the same on both, or one Filter does not have the virtual host./mikiri-waf-test or another path the Filter blocks.