1

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required:

Web Application Firewall is in-line with the web servers; it intercepts and inspects incoming and outgoing traffic, preventing attacks from reaching the web servers and preventing the leak of sensitive data to the requesting clients

  1. Proxy Server
  2. Detection Engine
  3. Signature for detecting malicious requests

    Client ---> WAF Server ---> Origin Server

The idea is that my client will be just adding A records to his domain name and traffic will be forwarded to my server and once it is filtered, it will be sending to original server.

My question, first, please provide me some pointers to implement this server which will forward request to the original IP address of client.

Second, How can I handle nameservers ? As they will be leaking orignal IP address of the server. Then it will be easy to bypass the WAF.

closed as too broad by thexacre, Stephane, Steffen Ullrich, Scott Pack, M'vy Jul 20 '15 at 12:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Have you looked at how other WAFaaS operate? CloudFlare for example is a well known user of Nginx and they provide DNS hosting which resolves some complications. – thexacre Jul 20 '15 at 6:50
  • You have guidelines to setup similar server ? – SSK Jul 20 '15 at 8:08
  • I've found this link for Reserve Proxy. – SSK Jul 20 '15 at 10:30
  • SSK - I see all your questions have been closed so far. I'd suggest re-reading the tour and How to Ask pages to understand what is on topic here. – Rory Alsop Jul 21 '15 at 8:11
2

regarding question 1:

You can setup most webservers as a reverse proxy(IIS, Apache, Nginx and even NodeJS all work). IIS and Nginx are preferable(but not necessary) as they are faster(just my opinion - this may not always be true).

Instructions for setting up IIS as a proxy can be found here

Instructions for setting up Nginx as reverse proxy

there are also ready made WAFs out there in the form of VMs which you can use. barracuda is one example(seems to use Nginx under the hood)

regarding Question 2:

you can do two things

  1. make sure that the webservers only accepts connections from the public ip of your web proxy.

  2. the webserver will only allow connections after validating the Client certificate of the proxy SaaS. requires TLS and also the web servers should implement client certificate verification.

  3. use a Tunnel(VPN) between the webserver and the proxy and hide the webserver from the rest of internet

hope it helps.

  • What if we go for Apache Trafficserver ? It seems to be good and which is used by Yahoo. – SSK Jul 21 '15 at 6:58
  • if Apache suits your needs, you can use it. there are so many other variables to consider here. the web server is only part of the puzzle. – JOW Jul 21 '15 at 8:35
  • 1
    exactly. I'm trying to install TrafficServer of Apache. Lets Hope for the best. If you have any other suggestion then let me know. – SSK Jul 21 '15 at 8:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.