You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In this guide, we will showcase how to deploy the CrowdSec WAF as a Nginx Reverse Proxy, easily protecting a fleet of other web applications from a single point.
8
+
In this guide, we will showcase how to deploy the CrowdSec WAF with Nginx reverse proxy, easily protecting a fleet of other web applications from a single point.
9
9
10
-
We will set up a reverse proxy (Nginx) boosted with CrowdSec in front of our web server (Apache) to block malicious traffic before it reaches our application.
10
+
We will set up a reverse proxy (Nginx) protected with CrowdSec in front of our web server (Apache) to block malicious traffic before it reaches our application.
11
11
12
12
**This article dives into the technical details of configuring CrowdSec WAF.**
13
13
14
14
To achieve robust protection, we'll use two key components that work in tandem: the **Security Engine** and the **Web Application Firewall (WAF)***– enabled by an AppSec-capable Remediation Component aka **Bouncer**, in our case, CrowdSec’s NGINX Bouncer*
15
15
16
-
**The Security Engine**: excels at identifying persistent or recurring behaviours. It analyzes your web server/reverse proxy logs to identify suspicious patterns of behavior. For example, the http-probing scenario detects IPs rapidly requesting a large number of non-existent files – a common tactic used by vulnerability scanners searching known vulnerabilities, backdoors, or publicly exposed admin interfaces. While powerful and able to protect a large number service from various log sources, the Security Engine reacts **after** the suspicious event, once it’s logged by your web server.
16
+
**The Security Engine**: excels at identifying persistent or recurring behaviours. It analyzes your web server/reverse proxy logs to identify suspicious patterns of behavior. For example, the http-probing scenario detects IPs rapidly requesting a large number of non-existent files – a common tactic used by vulnerability scanners searching known vulnerabilities, backdoors, or publicly exposed admin interfaces. While powerful and able to protect a large number service from various log sources, the Security Engine reacts **after** the request have been processed by your web server.
17
17
18
-
**The Web Application Firewall (WAF):** The WAF acts as your immediate gatekeeper, blocking malicious requests before they even reach your application or backend. With the help of the bouncer relaying the requests to the AppSec engine, it will apply virtual patching rules to block requests that are, without a doubt, malevolent. A great example is the `vpatch-env-access` rule, which blocks requests attempting to access .env files (which should never be publicly accessible\!). Our vpatching collection has hundreds of rules tailored to precisely block vulnerability attempts
18
+
**The Web Application Firewall (WAF):** The WAF acts as your immediate response, blocking malicious requests before they even reach your application or backend. With the help of the bouncer/remediation component relaying the requests to the AppSec engine, it will apply virtual patching rules to block requests that are, without a doubt, malevolent. A great example is the `vpatch-env-access` rule, which blocks requests attempting to access .env files (which should never be publicly accessible\!). Our vpatching collection has hundreds of rules tailored to precisely block vulnerability attempts.
19
+
20
+
:::info
21
+
Virtual Patching Rules focus on detecting and preventing the exploitation of a specific vulnerability, allowing very minimal risk of false positives.
22
+
:::
19
23
20
24
**Together, these components provide layered protection, making it significantly harder for attackers to succeed.**
21
25
22
-
WAFs are powerful, but no matter what WAF vendors make you believe, determined attackers can often find ways to bypass your WAF configuration. Here, the Security Engine will rely on the WAF detection to make longer-term decisions against repeating malevolent IPs. This is what the `appsec-vpatch` scenario does: it bans IPs that trigger at least two distinct WAF rules for several hours.
26
+
WAFs are powerful, but no matter what WAF vendors make you believe, determined attackers can often find ways to bypass your WAF configuration. Here, the Security Engine will rely on the WAF detection to make longer-term decisions against repeating malevolent IPs.
23
27
24
28
## Initial Setup
25
29
@@ -36,8 +40,8 @@ server {
36
40
server_name _;
37
41
38
42
location / {
39
-
proxy_pass http://Y.Y.Y.Y:3000; # Your backend app
40
-
proxy_set_header X-Real-IP $remote_addr;
43
+
proxy_pass http://Y.Y.Y.Y:3000; # Allows passing requests to the backend web server.
44
+
proxy_set_header X-Real-IP $remote_addr; # Important to keep track of the original IP.
At this stage, check that the IPs appearing in your Apache's and Nginx's log are the real originating IP.
121
+
At this stage, check that both Apache's and Nginx's logs are the real originating IP (ie. `A.B.C.D`)
118
122
119
123
:::
120
124
121
-
## Time to beef up our security - Security Engine
125
+
## Time to level up our security - Security Engine
122
126
123
127
As soon as our server is online, hordes of malevolent IPs will jump on it with clear bad intentions. What is currently happening is this:
124
128
@@ -128,16 +132,16 @@ Thus, it is time to step up our security with CrowdSec. We will deploy the Secur
128
132
129
133
130
134
131
-
To install CrowdSec on our reverse proxy, let’s grab the crowdsec repository:
135
+
To [install CrowdSec on our reverse proxy](https://doc.crowdsec.net/u/getting_started/installation/linux), let’s grab the crowdsec repository:
132
136
133
137
```bash
134
-
$ curl -s https://install.crowdsec.net | sudo sh
138
+
curl -s https://install.crowdsec.net | sudo sh
135
139
```
136
140
137
141
And let’s install crowdsec:
138
142
139
143
```bash
140
-
# apt install crowdsec
144
+
sudo apt install crowdsec
141
145
```
142
146
143
147
The relevant part of the install log is the following:
@@ -164,7 +168,7 @@ Accept it in the console:
164
168
To complete our setup, we need the ability to block bad IPs and requests before they reach Apache, our little bro. We will install the Nginx bouncer (or remediation component) for this. The bouncer can block IPs when instructed by CrowdSec. As simple as this:
0 commit comments