Skip to content

Feature Guide WAF

Jump to bottom
fuomag9 edited this page May 6, 2026 · 2 revisions

Feature Guide: WAF

Web Application Firewall powered by Coraza with optional OWASP Core Rule Set.

Table of Contents

  1. Overview
  2. Enable the WAF
  3. Per-Host Configuration
  4. WAF Events
  5. Rule Suppression
  6. Custom Directives
  7. Troubleshooting

Overview

The WAF inspects incoming HTTP requests and applies rule-based detection. When a request matches a rule it is either:

  • Blocked — the request is rejected with HTTP 403
  • Detected — the request is logged but allowed through

Events are recorded per request and visible in WAF → Events.

Enable the WAF

  1. Open WAF in the sidebar.
  2. Click the Settings tab.
  3. Toggle Enable WAF globally (blocking).
  4. Optionally check Load OWASP Core Rule Set (recommended — covers SQLi, XSS, LFI, RCE, and more).
  5. Click Save WAF settings.

Configuration takes effect immediately on the next request.

Per-Host Configuration

Each proxy host can override the global WAF setting:

  • Disabled — WAF off for this host, regardless of global state
  • Global (default) — inherit global WAF settings
  • Custom — enable/disable, OWASP CRS, custom directives, and rule suppressions specific to this host

Hosts using Custom mode merge their settings with (or completely override) the global config.

To configure:

  1. Open the proxy host dialog (edit an existing host or create a new one).
  2. Scroll to the WAF section.
  3. Select the desired mode and fill in any custom settings.

WAF Events

The Events tab shows a searchable, paginated log of all WAF activity.

Period filters

Time range filters above the table let you scope which events are shown:

Filter Window
All All stored events (default)
24h Last 24 hours
7d Last 7 days
30d Last 30 days
Custom Date/time pickers for start and end

Stats bar

Above the table, a stats bar shows totals for the selected period — total events, blocked count, detected count, and unique client IPs.

Columns

Column Description
Time When the request arrived
Action Blocked or Detected
Severity CRITICAL, ERROR, HIGH, WARNING, NOTICE, INFO
Host The proxy host that handled the request
Client IP Source IP address, with country code if GeoIP is configured
M HTTP method
URI Request path
Rule ID OWASP CRS or custom rule that matched
Rule Message Human-readable rule description

Event Detail

Click any row to open an inline detail panel below the table (not a modal or drawer). The panel stays visible while you browse the table, and scrolls into view automatically when a row is clicked.

The panel has four tabs:

Tab Contents
Summary Rule ID, severity, action, host, client IP, method, URI. Quick-suppress buttons (globally or per host) are here.
Request Full HTTP request details — method, protocol, URI, headers, and body if present
Response Response status, protocol, and headers
Raw Audit Raw Coraza audit JSON, pretty-printed and scrollable

Search

Search filters by host, client IP, URI, or rule message. Results are paginated server-side.

Rule Suppression

Suppressing a rule removes it from the WAF for all matching requests. Use this to fix false positives.

Global suppression

Suppressed rules apply to all hosts using global WAF settings. Rules suppressed globally use SecRuleRemoveById under the hood.

  • From an event: open the detail drawer → click Suppress Globally
  • From the tab: WAF → Suppressed Rules → enter a rule ID and click Look up → Suppress Globally

Per-host suppression

Suppressed rules apply only to the specific host where the event triggered.

  • From an event: open the detail drawer → click Suppress for {host}

Per-host suppressions are stored in the host's custom WAF config.

Remove a suppression

Open WAF → Suppressed Rules and click the delete icon next to the rule.

Custom Directives

Advanced users can write raw ModSecurity SecLang directives in the Custom SecLang Directives field (WAF Settings tab, or per-host config).

Directives are applied after the OWASP CRS when both are enabled.

Common patterns

Allow an IP unconditionally:

SecRule REMOTE_ADDR "@ipMatch 1.2.3.4" "id:9000,phase:1,allow,nolog,msg:'Allow IP'"

Disable WAF for a path:

SecRule REQUEST_URI "@beginsWith /api/" "id:9001,phase:1,ctl:ruleEngine=Off,nolog"

Remove all XSS rules:

SecRuleRemoveByTag "attack-xss"

Block a specific User-Agent:

SecRule REQUEST_HEADERS:User-Agent "@contains badbot" "id:9002,phase:1,deny,status:403,log"

Quick Templates are available in the UI (click Quick Templates in the Settings tab).

Troubleshooting

Requests blocked that shouldn't be

  1. Check the event in WAF → Events and note the Rule ID.
  2. Use Suppress Globally or Suppress for host from the event drawer.
  3. If many rules are firing for legitimate traffic, consider disabling the OWASP CRS and enabling only specific rule categories via custom directives.

No events appearing

Checks:

  1. Verify WAF is enabled (WAF → Settings toggle is on).
  2. Confirm traffic is reaching the proxy host (check Caddy access logs).
  3. If the WAF was enabled after creating a proxy host, verify the host configuration was re-applied (edit the host and save).

WebSocket connections failing

The WAF is WAF-aware for WebSocket upgrade requests. If WebSocket connections fail after enabling the WAF, check the WAF events for blocked upgrade requests and suppress the relevant rules.

Related Documentation

Need help? Open an issue with the rule IDs, request details (no sensitive data), and relevant logs.

Clone this wiki locally