loveshell/ngx_lua_waf
Ngx Lua Waf
ngx_lua_waf is an OpenResty web application firewall that uses Lua to filter malicious HTTP requests and block web attacks. It operates as a programmable request filter and IP access controller for Nginx, providing a security layer to identify and block unauthorized scanners, fuzzing attempts, and abnormal network requests.
The project includes capabilities for HTTP layer 7 DDoS mitigation by restricting request frequency per IP address. It further secures the environment by restricting access to sensitive archives and blocking script execution in upload directories to prevent data leakage.
The system manages security through regular expression pattern matching across URLs, headers, cookies, and POST bodies to block threats such as SQL injection and XSS. It provides administrative tools for managing IP white-lists and black-lists, logging security events for auditing, and synchronizing firewall rules from a remote server.
Features
- NGINX Extensions - Implements security logic as a programmable extension within the Nginx request processing pipeline using Lua.
- Web Application Firewalls - Implements a web application firewall that protects services from SQL injection and XSS via real-time HTTP traffic inspection.
- Network Request Filters - Uses regular expression rules to inspect and block common web threats such as SQL injection and XSS.
- Programmable Request Filters - Provides a programmable Lua-based engine to scan HTTP headers and request bodies for malicious injection patterns.
- Regex Pattern Matching - Scans request headers and bodies against predefined regular expression rules to identify and block web attacks.
- Layer 7 Rate Limiters - Mitigates Layer 7 DDoS attacks by restricting the frequency of requests allowed from a single IP address.
- Access Control Lists - Controls network traffic by permitting or blocking requests based on defined IP white-lists and black-lists.
- IP Address Filtering - Filters network traffic by comparing client IP addresses against configured white-lists and black-lists.
- Denial of Service Prevention - Mitigates high-frequency stress testing and coordinated attacks by limiting the request rate per IP address.
- DoS Attack Defenses - Prevents server resource exhaustion by implementing defenses against flooding and DoS attack patterns.
- File Upload Security - Scans POST data and uploaded file extensions for malicious patterns to prevent injection and file-upload attacks.
- Payload Inspection - Analyzes request bodies and uploaded file extensions for malicious patterns to stop injection and file-upload threats.
- Malicious Traffic Blocking - Filters incoming network traffic to block unauthorized scanners, fuzzing attempts, and other malicious request patterns.
- Request Body Inspection - Inspects URLs, POST bodies, and cookies for malicious patterns to block abnormal network requests.
- Scanner Traffic Filtering - Inspects request methods, headers, and cookies to identify and block unauthorized scanners and malicious traffic.
- Web Attack Blocking - Filters incoming requests for common injection and fuzzing attempts using configurable regular expression rules.
- IP-Based Rate Limiting - Prevents denial of service attacks by restricting the number of requests allowed per IP address.
- Traffic Management - Controls traffic based on IP lists and concurrency limits to protect server resources from exhaustion.
- Remote Rule Synchronization - Updates firewall protection patterns by downloading and synchronizing new configuration files from a remote server.
- IP Allow/Deny Lists - Manages access to the server by permitting or blocking requests based on defined IP white-lists and black-lists.
- Path Access Restrictions - Blocks unauthorized access to sensitive archives and prevents script execution in specific directories.
- Sensitive File Protections - Blocks public web access to sensitive archives and prevents script execution in upload directories to prevent data leakage.
- Firewall Rule Synchronization - Synchronizes firewall security policies by downloading new rule files from a remote server.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
