Why You Need a WAF
A Web Application Firewall (WAF) is essential for protecting your web applications from common attacks like SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It acts as a filter between the client and your server, inspecting requests and blocking malicious traffic.
The 5-Phase Pipeline
ModSecurity operates in five key phases:
- Request Headers – Inspect incoming headers.
- Request Body – Analyze POST data and file uploads.
- Response Headers – Check outgoing headers for information leaks.
- Response Body – Prevent sensitive data exposure or hidden injections.
- Logging – Record all events for auditing and analysis.
Installing ModSecurity + CRS
- Install ModSecurity (the WAF engine) via your package manager. For example, on Ubuntu:
sudo apt install libmodsecurity3 - Download the OWASP Core Rule Set (CRS) from the official repository:
git clone https://github.com/coreruleset/coreruleset /etc/nginx/owasp-crs - Configure Nginx to load ModSecurity and include the CRS rules. Add this to your server block:
modsecurity on; modsecurity_rules_file /etc/nginx/modsec/main.conf;
The Rollout: Detect → Block
Start in detection-only mode to monitor traffic without disruption:
SecRuleEngine DetectionOnly
After reviewing logs and fine-tuning exclusions, switch to blocking mode:
SecRuleEngine On
Paranoia Levels & Exclusions
CRS offers four paranoia levels (1–4). Higher levels catch more subtle attacks but increase false positives. Start at level 1 and escalate gradually. For false positives, create exclusions by adding rules that ignore specific parameters or paths:
SecRuleUpdateTargetById 942100 "!ARGS:allowed_param"
Production Config Tips
- Enable SecAuditEngine to log all transactions.
- Use SecRequestBodyAccess to inspect POST bodies.
- Set SecResponseBodyAccess to Off unless needed (performance).
- Regularly update CRS rules (monthly recommended).
- Monitor logs for blocked vs. passed requests to tune exclusions.
Conclusion
Combining Nginx with ModSecurity and OWASP CRS provides robust, lightweight web protection. The key is a gradual deployment: detect, tune, then block. This approach minimizes false positives while maximizing security.