Setup Nginx as a Reverse Proxy and WAF with ModSecurity in Docker

Nginx is a highly versatile web server which can effectively function as a reverse proxy and web application firewall (WAF). To function as a WAF, the ModSecurity WAF module is usually used with the OWASP ModSecurity Core Rule Set.

The ModSecurity WAF module will check incoming requests and outgoing responses against the rules it has loaded. If the request matches one of the rules, it will be ended before it is passed to the web application. The OWASP ModSecurity Core Rule Set contains generic rules intended to protect web applications from a variety of common attacks such as SQL injection and XSS.

I run a few different applications using Docker, mostly because it makes them easier for me to manage and update. Part of this includes an Nginx container which acts as a reverse proxy for the other web application containers. To help increase security I used a Nginx image with a WAF built in.

Creating the reverse proxy docker network

The network used by the reverse proxy to connect to the containers we’d like to expose will be used by a few different services. Because of this, it is best to create it separately. We can do this with a quick docker command.

docker network create reverse-proxy

Setup Nginx with ModSecurity Web Application Firewall

The free Nginx docker image does not include the ModSecurity module required load and process the OWASP ModSecurity Core Rule Set. This leaves the option of building a new image which includes the necessary module or finding an image from a different provider which already includes the module.

Thankfully, OWASP provides this docker image includes ModSecurity and the core rule set. This makes everything simpler and easier to manage, as to update the rules of Nginx version only the new docker image needs updating and the container recreating.

The following docker compose file will create a container which connects to the reverse-proxy network which will allow it to communicate with the containers it needs to proxy requests for. It will also setup a volume binds to allow the proxy configuration to be managed. This is a file named proxy.conf.

Nginx WAF Docker Compose

#root@kernel:/home/agungsurya/modsecuritydokcer/docker-compose.yml
version: "3.3"

services:
  reverseproxy:
    container_name: reverse-proxy-nginx-agungsurya
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /home/agungsurya/modsecuritydokcer/proxy.conf:/etc/nginx/conf.d/proxy.conf:ro
      - /home/agungsurya/modsecuritydokcer/apache-selfsigned.key:/etc/ssl/private/apache-selfsigned.key:ro
      - /home/agungsurya/modsecuritydokcer/apache-selfsigned.crt:/etc/ssl/certs/apache-selfsigned.crt:ro
      - /home/agungsurya/modsecuritydokcer/403.html:/var/www/html/403.html:ro
    environment:
      - PROXY=1
    restart: always
    image: agungsurya/reverse-proxy-nginx-modsecurity:v1
    networks:
      reverse-proxy:
        aliases:
          - reverse-proxy-nginx
networks:
  reverse-proxy:
    external: true

Proxy Configuration

#root@kernel:/home/agungsurya/modsecuritydokcer# cat proxy.conf
server {
  listen 80;
  listen [::]:80;

  server_name modsecurity.agungsurya.my.id;

  location / {
      proxy_pass http://prometheus.agungsurya.my.id/;


  }
}


 server {
    listen 443 ssl;
    listen [::]:443 ssl;

    ssl_certificate /etc/ssl/certs/apache-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/apache-selfsigned.key;


#/etc/ssl/private/apache-selfsigned.key
#/etc/ssl/certs/apache-selfsigned.crt

    server_name modsecurity.agungsurya.my.id;

    location / {
        proxy_pass https://prometheus.agungsurya.my.id;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

   }
}

tambahan kalau menggunakan https jika tidak menggunakan https hapus server listen ssl nya cukup seperti ini kalau http saja

server {
  listen 80;
  listen [::]:80;

  server_name modsecurity.agungsurya.my.id;

  location / {
      proxy_pass http://prometheus.agungsurya.my.id/;


  }
}

ini ssl cert kalau pakai https

agungsurya@kernel:~/modsecuritydokcer$ cat apache-selfsigned.crt

root@kernel:/home/agungsurya/modsecuritydokcer# cat apache-selfsigned.key

Starting to Reverse Proxy

Starting to Reverse Proxy You will need to make sure that all volume binds and container names match the above, or have been amended to match your environment as needed. When this is all in place you can start the reverse proxy using docker compose with the following command.

docker-compose up

Nginx as a Reverse Proxy and WAF with ModSecurity in action

sebelum instalasi server proxy waf nginx dengan modsecurity alisa server langsung tanpa proxy

sesudah instalasi dan konfigurasi server proxy waf nginx dengan modsecurity alisa server dengan proxy nginx