Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required:
Web Application Firewall is in-line with the web servers; it intercepts and inspects incoming and outgoing traffic, preventing attacks from reaching the web servers and preventing the leak of sensitive data to the requesting clients
- Proxy Server
- Detection Engine
Signature for detecting malicious requests
Client ---> WAF Server ---> Origin Server
The idea is that my client will be just adding A records to his domain name and traffic will be forwarded to my server and once it is filtered, it will be sending to original server.
My question, first, please provide me some pointers to implement this server which will forward request to the original IP address of client.
Second, How can I handle nameservers ? As they will be leaking orignal IP address of the server. Then it will be easy to bypass the WAF.