NGINX ModSecurity WAF

The F5 NGINX ModSecurity web application firewall (WAF) is built on ModSecurity 3.0.

Note:
The ModSecurity WAF module was deprecated since NGINX Plus Release 29, and is no longer available since NGINX Plus Release 32

Installation

  1. Check the Technical Specifications page to verify that the module is supported by your operating system.

  2. Install the NGINX ModSecurity WAF module package nginx-plus-module-modsecurity.

    For Amazon Linux 2, CentOS, Oracle Linux, and RHEL:

    sudo yum update && \
sudo yum install nginx-plus-module-modsecurity
    Note:
    ppc64le is currently not supported for Amazon Linux, CentOS, Oracle Linux, and RHEL.

    For Amazon Linux 2023:

    sudo dnf update && \
sudo dnf install nginx-plus-module-modsecurity

    For Debian and Ubuntu:

    sudo apt update && \
sudo apt install nginx-plus-module-modsecurity
    Note:
    aarch64 and ppc64le is currently not supported for Ubuntu.

    For SLES:

    sudo zypper refresh && \
sudo zypper install nginx-plus-module-modsecurity

    For Alpine:

    apk add nginx-plus-module-modsecurity

Configuration

After installation you will need to enable and configure the module in NGINX Plus configuration file nginx.conf.

  1. Enable dynamic loading of the module with the load_module directive specified in the top-level (“main”) context:

    load_module modules/ngx_http_modsecurity_module.so;

http {
    # ...
}

  2. Perform additional configuration as required by the module.

  3. Test the NGINX Plus configuration. In a terminal, type-in the command:

    nginx -t

    Expected output of the command:

    nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf is successful

  4. Reload the NGINX Plus configuration to enable the module:

    nginx -s reload

  5. Configure the module.

More Info