eWAF (Web Application Firewall)

🔗 eWAF.io / the only website

Smart Hybrid Routing & Enterprise Grade Security

---

🇪🇸 Leer en Español

eWAF is a high-performance Hybrid Reverse Proxy and Web Application Firewall. It combines the intelligent dynamic routing and payload inspection of a Java Native Engine with the raw C++ power of NGINX and the OWASP ModSecurity Core Rule Set (CRS).

✨ Core Features

• 🛡️ Dual Firewall System (Dual WAF): Combines a high-performance Perimeter Firewall in C++ (NGINX + ModSecurity CRS) to block injection attacks, and a Core Logic Firewall in Java (Tomcat) for Rate Limiting, Session Control, and Honeypots.
• 🚦 Global & Smart ModSecurity CRS: The C++ WAF is active by default at the network edge (location /). Exclusions for safe routes are auto-generated dynamically from the Java web dashboard without manual intervention.
• 📊 Threat Interception "Inception": If ModSecurity blocks a brute force or injection attack, NGINX doesn't just drop the connection silently; it redirects the threat to a secret Tomcat corridor that logs the attack in MySQL and applies an instant permanent ban in RAM.
• 🔄 On-The-Fly Rewriting: The Java Native engine dynamically parses and manipulates JSON payloads and HTML anchors to fix broken backend paths seamlessly.
• ⚡ Multi-Engine Routing: Route your traffic through NATIVE (Tomcat), NGINX (Fast-path X-Accel-Redirect for heavy statics), or SPRING (Cloud Gateway) engines.

🏗️ Architecture Flow and the Two Firewalls

eWAF processes traffic using a Control Plane (Java) and Data Plane (NGINX) model:

1. Edge WAF (NGINX - Port 8081): All internet traffic enters here. ModSecurity evaluates traffic against strict OWASP rules. If an attack is detected (e.g., SQLi, XSS), it halts the flow, alerts Tomcat in the background for logging, and returns a 403 Error.
2. Core WAF (Tomcat - Port 8080): If traffic is clean, it enters Java. Here, eWAF's internal filters and config.properties settings take action.
3. Proxy Orchestrator: Once barriers are cleared, Tomcat delegates the final traffic using the selected engine (NATIVE, NGINX, or SPRING) to the destination server/backend.

📂 File Structure and Central Configuration

The ecosystem's complexity is managed through key files and shared volumes:

• WEB-INF/config.properties: The Java Brain. Here you define eWAF's configuration, different Rate Limit types and limits, IP Whitelist, and inspection routes.
• docker-compose.yml: The Infrastructure. Configures ports, DB linking, and ModSecurity core variables (Defines the Paranoia Level and anomaly tolerances with PARANOIA=1, ANOMALY_INBOUND=5).
• nginx-config/default.conf: The Network Edge. Contains the global redirection to Tomcat, ModSecurity enablement, and the @modsec_block that captures ModSecurity blocks to send them to the Java logger for integration with eWAF logs.
• nginx-config/generated/: Shared Volume. A vital folder where Java code injects exclusion rules (ewaf-modsec-exclusions.conf) and triggers the reload.trigger for NGINX to update itself in real-time.
• nginx-config/modsecurity.conf: Custom ModSecurity Rules. Connects with the auto-generated exclusions and serves as the master section to add custom rules and exceptions for the C++ WAF.
• src/main/java/com/ewaf/WafInterceptServlet.java: The Logger. A protected Servlet (/internal-waf-logger) that receives block reports from NGINX, logging them in the metrics Dashboard and triggering countermeasures.
• src/main/webapp/META-INF/context.xml: DB Credentials. Used to define the database connection established in the docker-compose.

---

🚀 Deployment Guide

Prerequisites

• Docker & Docker Compose
• Java 17 & Maven (To build the core application)

Step 1: Build the Core

Before spinning up the containers, package the Java application using the included Maven Wrapper. This will generate the target/eWAF.war file required by Tomcat.

For fresh Linux Servers (Ubuntu/Debian):

git clone https://github.com/whitehatlabs000/eWAF.git
cd eWAF
sudo apt update
sudo apt install openjdk-17-jdk -y
chmod +x mvnw
./mvnw clean install

For Local Development (Windows/Mac with Java installed):

git clone https://github.com/whitehatlabs000/eWAF.git
cd eWAF
./mvnw clean install

Step 2: Choose your Environment

eWAF is designed with a hybrid profile system to adapt to your workflow.

Option A: Local Development (Windows / Mac / IDE)

In this mode, Docker runs the infrastructure (MySQL, NGINX, Spring Gateway), but leaves Tomcat offline so you can run the Java code directly from your IDE (IntelliJ/Eclipse) for debugging.

docker compose up -d --build

Run your Tomcat server from your IDE on port 8080. It will automatically connect to the containerized MySQL on port 3308.

Option B: Production Deployment (Linux / Server)

In this mode, the entire ecosystem (including the Java Core) runs containerized within the isolated Docker network.

docker compose --profile prod up -d --build

Step 3: Access Ports and Web Dashboard

The ecosystem uses two main ports by security design:

• Port 8081 (Edge / Public Access): All normal and internal traffic must enter here. It is protected by Level 1 (NGINX/ModSecurity) and Level 2 (eWAF-Java).

Once deployed, navigate to http://localhost:8081/login. The database is auto-provisioned with the following default credentials:

• Username: admin
• Password: admin

⚠️ Important for Developers! To prevent the Firewall from permanently banning you while performing stress tests or SQLi/XSS injections, add the real IP of your machine (e.g., 172.19.0.1 in local Docker) to the security.whitelist.ips variable inside the config.properties file. ⚠️ Important for Developers! If you were banned and lost access, you can remove your IP from the blocked-ips.txt file configured inside config.properties and restart. ⚠️ Important for Developers! If a route is generating too many logs or false positives, you can bypass them by configuring its omission inside the config.properties file. ⚠️ Important for Developers! For a quick deployment, configure a Cloudflare tunnel pointing to http://localhost:8081.

---

🛠️ Docker Administration Cheatsheet

Manage your eWAF deployment using these standard Docker Compose commands:

# View real-time logs for all services
docker compose logs -f

# View logs for a specific engine (e.g., ModSecurity blocks)
docker compose logs -f nginx

# Restart NGINX to apply manual rule changes without dropping the DB
docker compose restart nginx

# Stop the entire ecosystem safely
docker compose stop

# Tear down the ecosystem (Keeps database data safe in volumes)
docker compose down

# FULL RESET: Tear down and delete database volumes (DANGER: Wipes all data)
docker compose down -v

---

🤝 Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create.

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

📝 License

Distributed under the GNU AGPLv3 License. See LICENSE for more information.

Contact and donations

Mail: ezequielmesa@proton.me BTC: 1LUw27B6wPNibZKrPJGCigV642358rpABg ETH/ERC20: 0x22a1dd7cd753ba5c52db23d927fc6ded7025579d