WAF for HAProxy (Reverse Proxy)

skalyx · Dec 15, 2021, 10:54 AM

Hello everyone,

We have a reverse proxy with HAProxy on Pfsense and it works great. To be honest, we are very satisfied with Pfense. However, there is no "WAF" for our reverse proxy. Is there any way for us to mitigate threats such as OWASP top 10 on HAPoxy with Pfsense?

We have some web services that are public-facing and want to protect them as much as possible. They already are behind Cloudflare proxy.

Thanks!

DaddyGo · Dec 15, 2021, 10:03 PM

@skalyx said in WAF for HAProxy (Reverse Proxy):

However, there is no "WAF" for our reverse proxy.

Hi,

I'm sorry, but I think you are confusing the concepts of NGFW and WAF in this case,.... firewall and web firewall...

pfSense, even if you use the proxy option, will not give you WAF..

pls. install a WAF, behind the web server system, be it VPS? shared hosting, whatever

best and simple for you is a paid plan with CF (CloudFlare with WAF)
or install a free ComodoWAF
or Atomic OSSEC
or this https://github.com/SpiderLabs/ModSecurity

skalyx · Dec 16, 2021, 9:41 AM

@DaddyGo
Thanks a lot for your response. I am not really confusing both, but I am not a subject matter expert for sure!!!

Actually, I am looking to secure my pfsense without adding too much overhead and investment, but Cloudflare's WAF seems to be a good solution to be honest... Is there nothing else we can do?

Thanks!

DaddyGo · Dec 16, 2021, 9:45 AM

@skalyx said in WAF for HAProxy (Reverse Proxy):

Is there nothing else we can do?

Nothing to do about in pfSense question, it is not recommended to install anything on a front-line protection device that has not been released by the manufacturer.

I can help, if you have questions about WAF, in short, we use Atomic products on our high-traffic sites and CWAF for lower loads.
(the high load sites are also behind the CF pay plan, so double WAF)

I suppose a CWAF would be enough for you at first?
https://waf.comodo.com/

It uses ModSec stuff and it's easy to use, it works well, I mostly use on Ubuntu FocalFossa, works from CLI too and if you don't like that you can go to Webmin under graphical interface

a little taste: (15TB NextCloud server on Ubuntu 20.04-03, Apache + PHP-fpm, PostgreSQL + ComodoWAF + ClamAV)

skalyx · Dec 17, 2021, 5:44 PM

@daddygo
I really appreciate the great answer. I see! I think I should go with both, but budget is something I am considering. I really miss time these days for my very small company and I am trying to keep costs as low as possible. However, I will really look at CWAF. It seems really promising!

Thanks again.