Internet, then Filter, then the application's Nginx, then the application. The other scenarios are listed in Deployment scenarios.
The visitor opens the site name. DNS points that name at the Filter. The Filter analyzes the request. A permitted request is proxied to the Nginx that already serves the application. That Nginx proxies to the application, as it did before Mikiri WAF was introduced. A blocked request is answered by the Filter and does not reach Nginx.
403.In WMC, open Web server for the CID of this Filter. 10.10.10.1 is the application's Nginx. Pass Host so that Nginx selects the same site it served before. Pass X-Real-IP so the application logs the visitor instead of the Filter. The fields are described in Web server settings.
WebSocket and gRPC locations are in Configuring Filter as a reverse proxy.
SSL → Add SSL Certificate. Name example.com. Paste the certificate and the private key.
Virtual hosts → Add a virtual host named example.com-http:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 80 |
| return | 301 https://$server_name$request_uri |
| Active | on |
Do not add a location. Save.
Add a virtual host named example.com:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 443 ssl |
| SSL certificate | example.com |
| Active | on |
Add location /:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://10.10.10.1 |
proxy_set_header:
| Header | Value |
|---|---|
| Host | $http_host |
| X-Real-IP | $remote_addr |
Save.
Send the test signature through the site name:
curl -i https://example.com/mikiri-waf-test
While example.com is in waf_host_dm, the Filter does not answer 403. The event is on the attacks page in WMC /var/log/mikiri-waf/filter/filter.log records signature ID 1. The application's Nginx still receives the request.
After example.com is removed from waf_host_dm, the same request is answered with 403 by the Filter. It does not appear in the access log of the application's Nginx.
waf_host_dm on until real traffic shows no mass false blocks, then remove the host. Otherwise the Filter keeps monitoring and does not block.403 after you expected blocking. example.com is still in waf_host_dm.X-Real-IP is missing on the Filter, or the application's Nginx overwrites it.502. The Filter cannot connect to 10.10.10.1, or that Nginx is not listening.