Setup

Setup

• Request beta access through our support team
• Log in to our new Customer Center at app.creoline.com
• Select the menu item Web Application Firewall → Create Instance.

Enter the full domain name of the website you want to protect as the domain name. Be sure to strictly separate the main domain from any subdomains. For example, if your web server performs a 301 redirect from my-shop.com to www.my-shop.com, the www. version must also be added to the WAF instance.

For the Upstream Host, you can use either the IPv4 address or the DNS hostname of your server. Please note that you cannot use your website’s domain name here, as it will be redirected to our Web Application Firewall via DNS in the next step.

Modifying the DNS Zone

The next step involves modifying your domain’s DNS records. If you want to protect a primary domain, change the DNS records as follows with your DNS provider:

Primary Domain

Example for my-shop.com 

Subdomain

Example for www.my-shop.com 

Once we have validated the DNS records, we automatically issue a matching SSL certificate, completely eliminating the need for you to manually issue or renew certificates.

Configuration in the Web Application

In the future, HTTP requests to your web application will first be routed through the Web Application Firewall and then forwarded to your web application. If your application evaluates the client’s IP address—for example, for logging or to store specific information—you will need to adjust the application.

WAF Request Headers

The following HTTP headers are sent by the WAF to the upstream server in every request:

General

The client’s IP address is included in the X-Original-IP request header. In addition, a chain of all IP addresses is sent via X-Forwarded-For.

Relevant GEO information is sent to the upstream via the X-Geo-* headers. For example, the client’s country can be determined via X-Geo-Country-Code.

Shopware / Symfony

In Shopware or Symfony, you must first configure a framework.yaml file that enables the internal TRUSTED_PROXIES configuration.

# config/packages/framework.yaml

framework:
    trusted_proxies: '%env(TRUSTED_PROXIES)%'

Next, the TRUSTED_PROXIES configuration can be set up in the .env.local file.

# .env.local

TRUSTED_PROXIES=127.0.0.1,5.1.73.196/32,5.1.73.88/32,5.1.73.201/32,5.1.73.79/32,5.1.73.86/32

Enter the source IP address of the load balancer in the TRUSTED_PROXIES configuration.

Configuration for an NGINX-based server

NGINX provides the set_real_ip_modules extension, which enables the translation of the original IP address. With the following adjustment, the correct IP addresses of the original clients are also stored in the NGINX access logs.

/etc/nginx/conf.d/zz-creoline-waf.conf

# creoline WAF
set_real_ip_from 5.1.73.196/32;
set_real_ip_from 5.1.73.88/32;
set_real_ip_from 5.1.73.201/32;
set_real_ip_from 5.1.73.79/32;
set_real_ip_from 5.1.73.86/32;

real_ip_header X-Forwarded-For;
real_ip_recursive on;

More information: https://nginx.org/en/docs/http/ngx_http_realip_module.html

Setup for a Plesk-based Web Server

Plesk includes the Fail2Ban package by default. Fail2Ban can be used to block unwanted IP addresses based on log entries. When the creoline WAF is enabled, incoming HTTP requests are sent from various IP addresses. An exception must be defined for Fail2Ban to prevent these IP addresses from being blocked unintentionally.

In the Plesk Control Panel, navigate to Tools & Settings → Blocking IP Addresses (Fail2Ban) → Trusted IP Addresses and add the following IP addresses:

More information on Fail2Ban →

Blocking Direct Access

Determine the WAF instance ID via our Customer Center at app.creoline.com.

Then add the following additional NGINX directive in Plesk for the corresponding website:

if ($http_x_waf_instance_id != "47e43bc0-37f5-49e6-b3c7-9bfc7f3c620b") {
  return 403;
}

Timeouts

The creoline Web Application Firewall currently supports a request timeout of 120 seconds. If the upstream server cannot provide a response within the set timeout of 120 seconds, the request is aborted with an HTTP error 504. Requests aborted by the WAF are also marked with a Timeout flag in the access log.