Where do you install WAF?

Due to the increasing development of technology and the need to introduce individuals/companies and the site of institutions in the cyberspace of the Internet/intranet, a great concern will arise, which is the website's security. Do content management systems store users' information securely and ultimately maintain information security? Given that all Internet users have access to the sites, it is very important what users should view from a site? Can a person access information outside of the specified chart defined for them?

WAF is an option between the firewall and the web server and is responsible for controlling users and preventing attacks that allow unauthorized users to access confidential information. is available in two types of software and hardware.

What is WAF, and what does it do?

Organizations typically store a large amount of their sensitive data in a backup database that can be accessed through web applications. Companies are also increasingly using mobile and Internet applications to facilitate their business interactions. Many of their online transactions occur at the application layer (the OSI 7 layer network, which the user can see and interact with the application). Most attackers, on the other hand, target applications for accessing customers' banking information. This is where app owners need WAF to protect their users' data. So WAF plays an important role in cyber security.

Web Firewall (or Web Application Firewall), also known as WAF, is an abbreviation responsible for protecting web applications against malicious attacks and unwanted Internet traffic, such as bots, code injection, and DDoS attacks. WAF helps you set rules to avoid cyber threats, including IP addresses, HTTP headers, HTTP body, URI strings, cross-site script (XSS), SQL injection, and other vulnerabilities defined by OWASP (Open Web Application Security Project). OWASP is an online community of people who produce free articles, documents, methodologies, and tools for web application security.

Webmasters often use WAF in conjunction with regular firewalls. The two firewalls then consider analyzing the relationship between the client and the webserver in sequence. In addition to HTML and HTTPS packets, a WAF can also analyze XML, RPC, and SOAP data.

How does WAF work?

WAF is part of a comprehensive security concept for web applications. It protects against specific cyberattacks such as intra-site forgery (CSRF attacks known as forging requests from other sites) and SQL injection (injecting SQL code into places such as forms or comment sections), which protects web applications. In this regard, WAF forms a protective wall between the web application and the Internet. Customers who want to access the webserver must first go through the web application firewall. WAF is an Application Level Firewall (ALF). But its distinctive feature is the fact that, unlike a conventional firewall, it does not operate at the network and protocol level but rather analyzes, filters, and blocks HTTP data directly at the application level.

The WAF firewall will protect web applications by monitoring HTTP traffic. But a standard firewall creates a barrier between external and internal network traffic. Therefore, WAF differs from ordinary firewalls in the type of protection it provides. A WAF is placed between external users and web applications to analyze all HTTP communications.

How to set up a Web Application Firewall in FreeBSD?

One of the security issues in protecting web servers is using programs called web application firewalls that prevent a series of unauthorized access to the webserver; to run this feature on FreeBSD, you need to install an add-on called ModSecurity, which you will learn in this part.

To get started, first update the ports structure in FreeBSD using the following command; this will allow you to install and use the latest version of this program, run the following command with the root user access level:

# portsnap fetch update

To use these sections, you must have access to the Internet because to update the structure of the ports; you need an Internet connection; now check your internet connection and run the following command:

# cd /usr/ports/www/mod_security

# make install clean

Well, after installing the main roles of this program, they will be located at the following directory address:

/usr/local/etc/apache22/Includes/mod_security2/

In this subdirectory, there is the main file called modsecuritycrs10_config.conf which you can open using a text editor and add these lines in the configuration file of this server to activate this program on your apache server:

LoadFile /usr/local/lib/libxml2.so

LoadModule security2_module libexec/apache22/mod_security2.so

Next, you need to restart your web server:

# /usr/local/etc/rc.d/apache22 restart

Now to check and get reports, there are three log files that you can see the names of these files below:

/var/log/httpd-modsec2_audit.log

/var/log/httpd-modsec2_debug.log

/var/log/httpd-error.log or virtual domain error.log file

How many types of WAFs are there?

There are three types of WAFs available on the market.

- Network-based WAF

Network-based WAF is usually hardware-based and is installed locally. However, this is the most expensive type of WAF and requires the storage and maintenance of physical equipment. Network-based WAFs are usually located directly behind the network firewall and in front of web servers. They analyze all the traffic passing through them. Therefore, this type of WAF takes a centralized approach. In this structure of WAF, a single component protects several web applications.

- Host-based WAF

Host-based WAF can be fully integrated into application software. This option is cheaper and more customizable than network-based WAFs, but it consumes extensive local server resources is complex to implement, and is expensive to maintain. A device used to run a host-based WAF often requires hardware and customization, which can be time-consuming and costly.

- Cloud SaaS WAF

This WAF is affordable and easy to implement. It usually does not even require an initial investment, and users pay a monthly or annual subscription to use this security service. Cloud-based WAF can be updated regularly at no extra cost and without any user effort. However, since you rely on a third party to manage your WAF, it is important to ensure that cloud-based WAFs have sufficient customization options to comply with your organization's business rules.

WAF capabilities

A WAF protects your web apps

- Attack signature databases

Attack signatures are patterns that may indicate malicious traffic, including known types of requests, abnormal server responses, and known malicious IP addresses. In the past, WAFs relied heavily on databases of these patterns that were ineffective against new or unknown attacks.

- Traffic pattern analysis based on artificial intelligence

Artificial intelligence algorithms make a behavioral analysis of traffic patterns possible to identify anomalies that indicate an attack. This allows you to identify attacks that do not conform to known malicious patterns.

- Application profile

An application profile includes an analysis of the structure of an application, including typical requests, URLs, values, and types of allowed data. This enables the WAF to detect and block potentially malicious requests.

- Customization

Operators can define security rules for application traffic. This allows organizations to customize WAF behavior to their needs and prevent legal and authorized traffic jams.

- Correlation engines

These engines analyze incoming traffic and triage it with known attack signatures, application profiles, artificial intelligence analysis, and customization to determine if the traffic should be blocked.

- DDoS protection platforms

You can integrate a cloud-based platform that protects against DDoS. If the WAF detects a DDoS attack, it can redirect traffic to the DDoS protection platform. This platform can handle a large number of attacks.

- Content Delivery Networks (CDNs)

WAFs are deployed on the edge network, so a cloud host WAF can provide a CDN to cache the website and improve its load time. It deploys CDN WAFs at multiple points of presence (PoPs) globally, thus providing users with the closest PoP services.

WAF technology

A WAF can be embedded in server-side software plugins or hardware components or provided as a traffic filtering service. WAFs can protect web applications from malicious or compromised endpoints and act as a reverse proxy (instead of a proxy server that protects users from malicious websites). WAFs, ensure security by intercepting and examining any HTTP request. They test illegal traffic using various CAPTCHA techniques and block them if they do not appear to be legal.

The WAF firewall will protect web applications by monitoring HTTP traffic. But a standard firewall creates a barrier between external and internal network traffic. Therefore, WAF is different from a normal firewall in the type of protection it provides. A WAF is placed between external users and web applications to analyze all HTTP communications.