mirror of
https://github.com/fabriziosalmi/patterns.git
synced 2025-12-29 16:15:12 +00:00
feat: Generate Nginx WAF config with separate map and rule files
This commit modifies the script to output two files: - waf_maps.conf (for http block) - waf_rules.conf (for server block) to avoid conflicts and provide more flexibility. This update should fix the bugged nginx rules integration on existing setups: https://github.com/fabriziosalmi/patterns/issues/8
This commit is contained in:
@@ -1,22 +1,30 @@
|
||||
# Nginx WAF Rule Snippets
|
||||
# Nginx WAF Configuration
|
||||
|
||||
This directory contains Nginx WAF rule snippets generated from OWASP rules.
|
||||
You can include these snippets in your existing Nginx configuration to enhance security.
|
||||
This directory contains Nginx WAF configuration files generated from OWASP rules.
|
||||
You can include these files in your existing Nginx configuration to enhance security.
|
||||
|
||||
## Usage
|
||||
1. Include the rule snippets in your `server` or `location` block:
|
||||
1. Include the `waf_maps.conf` file in your `nginx.conf` *inside the `http` block*:
|
||||
```nginx
|
||||
server {
|
||||
# Your existing configuration
|
||||
include /path/to/waf_patterns/nginx/*.conf;
|
||||
http {
|
||||
include /path/to/waf_patterns/nginx/waf_maps.conf;
|
||||
# ... other http configurations ...
|
||||
}
|
||||
```
|
||||
2. Reload Nginx to apply the changes:
|
||||
2. Include the `waf_rules.conf` file in your `server` block:
|
||||
```nginx
|
||||
server {
|
||||
# ... other server configurations ...
|
||||
include /path/to/waf_patterns/nginx/waf_rules.conf;
|
||||
}
|
||||
```
|
||||
3. Reload Nginx to apply the changes:
|
||||
```bash
|
||||
sudo nginx -t && sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
## Notes
|
||||
- The rules use `map` directives for efficient pattern matching.
|
||||
- The rules use `map` directives for efficient pattern matching. The maps are defined in the `waf_maps.conf` file.
|
||||
- The rules (if statements) are defined in the `waf_rules.conf` file.
|
||||
- Blocked requests return a `403 Forbidden` response by default.
|
||||
- You can enable logging for blocked requests by uncommenting the `access_log` line.
|
||||
|
||||
Reference in New Issue
Block a user