To use Filter as an intermediate server (reverse proxy), create the virtual host in WMC. Open Web server and select the CID of that Filter. The fields are described in Web server settings.
¶ Example of a virtual host configuration
The example below redirects HTTP to HTTPS, terminates TLS proxies / to the application. Optional locations analyze WebSocket and gRPC.
10.10.10.1 is the address of the application server.
-
Upstreams → Add new upstream. Name
app. Add server and set Server IP to10.10.10.1. Leave that server active and Save. -
SSL → Add SSL Certificate. Name
example.com. Paste the certificate and the private key.
- Virtual hosts → Add a virtual host named
example.com-http:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 80 |
| return | 301 https://$server_name$request_uri |
| Active | on |
Do not add a location. Save.
- Add a virtual host named
example.com:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 443 ssl |
| SSL certificate | example.com |
| Active | on |
- Add location
/:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://app |
proxy_set_header:
| Header | Value |
|---|---|
| Host | $http_host |
- Optional. Add location
/ws/:
| Field | Value |
|---|---|
| pass_type | waf_ws_proxy_pass |
| waf_ws_proxy_pass | http://app |
| proxy_http_version | 1.1 |
proxy_set_header:
| Header | Value |
|---|---|
| Upgrade | $http_upgrade |
| Connection | upgrade |
- Optional. Add location
/grpc/:
| Field | Value |
|---|---|
| pass_type | waf_grpc_pass |
| waf_grpc_pass | grpc://app |
Use grpc_pass instead when the body of the gRPC request does not need analysis.
- Leave the host Active and Save.
waf_ws_proxy_pass analyzes WebSocket requests. waf_grpc_pass analyzes gRPC requests, including the body.
¶ Displaying the real IP address of the visitor or the API client
If Filter is behind another proxy, for example a load balancer, open Web server → Global settings → Header settings.
Set real_ip_header to the header that proxy sends. The WMC offers X-Real-IP, X-Forwarded-For proxy_protocol. Add the proxy address to set_real_ip_from. An address, a hostname, or a CIDR such as 10.10.10.1/24 is accepted. Save.
10.10.10.1 in that list is the proxy that forwards requests to the Filter.
¶ Configuration templates
Snippets stores Nginx fragments that are not a field of their own. Add snippet takes a name and the fragment. Include that snippet from Global settings, from a virtual host, or from a location, in the include field.