ModSecurity WAF

ModSecurity is the go-to open-source WAF engine. Version 3 (libmodsecurity) plugs directly into nginx as a library. You get request and response inspection, regex-based rule matching, anomaly scoring, and full control over what gets blocked, allowed, or redirected. The module is just the engine. Rule sets are separate, and tuning them is real work. The OWASP Core Rule Set is the most widely used option and covers the OWASP Top 10. Start in detection mode, go through your logs for false positives, tune carefully, then switch to blocking. Skipping that step and going straight to prevention is a reliable way to start blocking legitimate traffic.

• Protect applications from SQL injection, XSS, and OWASP Top 10 attacks
• Apply the OWASP Core Rule Set to web-facing nginx instances
• Run in detection mode to audit traffic without blocking anything yet
• Add a WAF layer to infrastructure without modifying application code

A starting point. Adjust to taste.

# Inside your server {} or location {} block:
modsecurity on;
modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;

# After installing OWASP CRS separately:
# modsecurity_rules_file /etc/nginx/modsecurity/crs/crs-setup.conf;
# modsecurity_rules_file /etc/nginx/modsecurity/crs/rules/*.conf;

You'll need nginx from nginx.org configured first. These packages won't load on the distro nginx. Then add the Blendbyte repository if you haven't already:

sudo install -d -m 0755 /etc/apt/keyrings

curl -fsSL https://apt.blendbyte.net/nginx/blendbyte-archive-keyring.gpg \
  | sudo tee /etc/apt/keyrings/blendbyte.gpg >/dev/null

echo "deb [signed-by=/etc/apt/keyrings/blendbyte.gpg] https://apt.blendbyte.net/nginx $(lsb_release -cs) main" \
  | sudo tee /etc/apt/sources.list.d/blendbyte.list

sudo apt update
sudo apt install nginx-module-modsecurity

Most modules auto-enable on install. If yours didn't:

$ sudo ln -s /etc/nginx/modules-available/50-mod-modsecurity.conf \
  /etc/nginx/modules-enabled/
$ sudo nginx -t && sudo systemctl reload nginx

We package this from the upstream open-source project. If it's a bug in the module itself (not in our packaging), report it upstream at github.com/SpiderLabs/ModSecurity-nginx ↗