WEB APPLICATION FIREWALL

Stop attacks at the door,
before they reach your app.

A Web Application Firewall inspects every incoming HTTP request against a library of attack signatures and blocks the malicious ones before nginx hands the request to your code. Cloudnan ships ModSecurity + the OWASP Core Rule Set per-site, with per-server toggles and a real-time block feed.

cloudnan.com / dashboard / waf

Web Application Firewall

web-01.cloudnan.dev

WAF Status

Enabled

Mode

Prevention

Blocks threats

Recent Activity (last 50)

Blocked

Detected

Rule Sets

Time	Client IP	Method	URI	Status	Rule
14:32:18	185.220.101.34	POST	/wp-login.php	blocked	CRS-942100 SQL Injection Attack critical
14:31:55	203.0.113.42	GET	/?id=1'+OR+'1'='1	blocked	CRS-942270 SQL Injection (UNION) critical
14:31:11	198.51.100.7	POST	/api/comment	blocked	CRS-941100 XSS Attack high
14:30:48	192.0.2.55	GET	/../../etc/passwd	blocked	CRS-930100 Path Traversal high
14:30:22	203.0.113.18	GET	/admin/.env	detected	CRS-913100 Scanner Detection medium
14:29:51	203.0.113.84	POST	/api/checkout	allowed	—

14 attacks blocked in the last 5 minutes — none reached your application.

How it works

Six checkpoints between the public internet and your code.

01
Request hits your nginx / Apache
Public traffic reaches the reverse proxy on port 80/443 like any other request. SSL terminates at the edge.
02
WAF inspects pre-app
ModSecurity processes the request against the loaded rule sets — OWASP Core Rule Set + custom rules — BEFORE upstream proxy_pass / php-fpm runs.
03
Score is computed
Each matching rule adds to a paranoia score. When the score crosses your threshold, the request is blocked with a 403 + audit entry.
04
Logs land in the panel
Blocked requests, paranoia scores, and rule matches stream into the WAF activity tab in real time. No SSH required to debug a false positive.
05
Tune from chat or panel
Disable a noisy rule, add a custom whitelist, or bump the paranoia level — through a click or by asking the AI Assistant.
06
Drift detection watches the rules
If anyone edits the WAF config outside the panel — over SSH, via a deploy hook — drift detection alerts you.

What you get

OWASP-grade protection, panel-configurable.

OWASP Core Rule Set

Industry-standard ruleset out of the box: SQLi, XSS, RFI, LFI, RCE, session-fixation, scanners, and more. Maintained upstream by the OWASP project, automatically updated.

Per-site toggle

Enable for production, disable for staging. WAF is scoped per nginx server block — no all-or-nothing.

Paranoia levels 1–4

Start at level 1 (well-tuned, low false positives). Crank up to 4 for compliance-grade environments where some false positives are acceptable.

Custom rules

Add per-site whitelists, IP allow lists, custom URL patterns. Stored versioned in the panel — every edit is audit-logged.

Detection mode

Run in 'detect only' mode for the first week to baseline traffic. Switch to blocking once you've tuned the false positives down.

Real-time activity feed

Streaming view of every blocked request — source IP, rule matched, paranoia score, payload preview. Ban an IP with one click.

Operating model

Detection mode first. Blocking when you're ready.

Most teams break their own production traffic by switching from no-WAF straight to maximum-paranoia blocking. Cloudnan defaults to detection-only for the first week so you can baseline what your app actually sends.

Day 1
Enable in detection mode
WAF logs every match but blocks nothing. Real traffic flows untouched while you collect data.
01
Day 1–7
Review the activity feed
Every false positive is a row in the panel. Whitelist legitimate patterns one at a time — usually 5-15 rules tops.
02
Day 8
Switch to blocking mode
Once the false-positive rate drops below your threshold, flip the toggle. Now every match returns 403 to the attacker.
03
Ongoing
Drift detection watches the rules
If anyone edits modsecurity.conf outside the panel, you get an alert. The WAF is part of your auditable surface area.
04

FAQ

What you'll want to know.

Will the WAF break my legitimate traffic?

Out of the box at paranoia level 1, false positives are rare. Always start in detection-only mode for the first 7 days, review the logs, and whitelist your specific patterns before switching to blocking.

Does it slow down requests?

Per-request overhead is typically <2ms on modern x86_64. ModSecurity runs in nginx's request-processing pipeline; no extra round-trips, no separate process, no proxy hop.

How is the WAF different from the firewall (UFW)?

The firewall blocks at the network layer (port, IP, protocol). The WAF inspects the actual HTTP payload and blocks application-layer attacks the firewall can't see — like a SQL injection in a POST body.

Can I write custom rules?

Yes — full ModSecurity rule syntax is supported. Add them through the panel's rule editor or via the AI Assistant ("block all requests where path contains 'phpmyadmin'"). Custom rules are versioned and audit-logged.

What logs do I get?

Every blocked request: timestamp, source IP, request URI, rule that matched, paranoia score contribution, payload preview, action taken. Searchable, exportable, retained per your plan.

How does Cloudflare in front of nginx interact with the WAF?

Both layers compose. Cloudflare blocks the obvious bot/DDoS noise at the edge; the on-server WAF catches application-specific attacks Cloudflare can't inspect (e.g., custom payload patterns specific to your app).

Related capabilities

Firewall (UFW)

Network-layer blocking. The companion to WAF's application-layer inspection.

Read

Fail2ban

Ban abusive IPs from log patterns — SSH brute force, repeated WAF triggers.

Read

Configuration Drift Detection

Knows when someone edits the WAF rules outside the panel.

Read