How to Create an Architecture with WAF in between Two Nginx

Deploying Nginx both before and after a WAF can help achieve load balancing, traffic forwarding, traffic control, and enhanced security.

Let's still take SafeLine as an example.

Typically, Nginx is deployed in front of SafeLine WAF as a reverse proxy, and another Nginx is deployed behind SafeLine WAF to handle traffic and application-level configurations.

Basic Architecture

1. Nginx + SafeLine WAF Architecture:

• Nginx (Front-end): Receives all client requests and handles load balancing, SSL/TLS termination, etc.
• SafeLine WAF: Filters the traffic passed through Nginx, providing threat detection and protection.
• Nginx (Back-end): Receives traffic filtered by SafeLine WAF and forwards it to application servers or processes specific requests.

Detailed Steps

Deploy SafeLine WAF in Front of Nginx

• Install and configure Nginx (as a reverse proxy):

sudo apt update
sudo apt install nginx

• Configure Nginx to forward traffic to SafeLine WAF: Edit the Nginx configuration file /etc/nginx/sites-available/default and add the following configuration:

server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;  # Forward to SafeLine WAF's address
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

• Restart Nginx to apply the configuration:

sudo systemctl restart nginx

Configure SafeLine WAF in the Backend

Configure SafeLine WAF to listen on the port and receive traffic forwarded by the front-end Nginx.

Assume SafeLine WAF is set to run on port 8080.

Ensure SafeLine WAF is working properly and filtering out malicious traffic.

Configure the Backend Nginx

On the back-end Nginx, you can further process the traffic passed through SafeLine WAF, such as load balancing, caching, and redirection. Ensure the back-end Nginx can receive traffic from SafeLine and forward it to the actual application server.

Example of backend Nginx configuration:

server {
    listen 80;
    server_name your-backend-domain.com;

    location / {
        proxy_pass http://your-backend-server;  # Application server handling real requests
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

• Restart the backend Nginx:

sudo systemctl restart nginx

4. Test and Optimize

• Ensure that the front-end Nginx, SafeLine WAF, and back-end Nginx work together properly. Traffic should flow smoothly during request processing.

• Use load balancing strategies, security enhancements, and caching mechanisms to optimize the performance of Nginx.

Summary

With this architecture, the front-end Nginx acts as a reverse proxy to forward requests to SafeLine WAF, which performs traffic security inspection and filtering. The filtered requests are then handled by the back-end Nginx, which forwards them to the application servers. This setup helps enhance website performance and security, while also improving scalability and management through flexible configuration.