ModSecurity is a widely-used, open-source web application firewall (WAF) — filtering malicious HTTP traffic (SQL injection attempts, XSS, and similar attack patterns) before it reaches your application.
What a WAF Adds Beyond a Standard Firewall
A traditional firewall filters based on network-level rules (IP, port); a WAF inspects the actual HTTP request content, detecting application-layer attack patterns that a network firewall alone can't see.
Prerequisites
- Nginx installed
- ModSecurity requires compiling as an Nginx module, or using a pre-built package if available for your distribution
Step 1 — Install ModSecurity and the Nginx Connector
sudo apt install libmodsecurity3 libnginx-mod-http-modsecurity -yStep 2 — Create the ModSecurity Configuration Directory
sudo mkdir -p /etc/nginx/modsec
sudo cp /usr/share/modsecurity-crs/crs-setup.conf.example /etc/nginx/modsec/crs-setup.confStep 3 — Download the OWASP Core Rule Set
cd /etc/nginx/modsec
sudo git clone https://github.com/coreruleset/coreruleset.gitThe OWASP Core Rule Set (CRS) provides a comprehensive, community-maintained set of generic attack detection rules — the standard starting point rather than writing rules entirely from scratch.
Step 4 — Create the Main ModSecurity Configuration File
sudo nano /etc/nginx/modsec/main.confInclude /etc/nginx/modsec/crs-setup.conf
Include /etc/nginx/modsec/coreruleset/rules/*.conf
SecRuleEngine OnStep 5 — Enable ModSecurity in Nginx
load_module modules/ngx_http_modsecurity_module.so;server {
location / {
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
proxy_pass http://backend;
}
}Step 6 — Test and Reload Nginx
sudo nginx -t && sudo systemctl reload nginxStarting in Detection-Only Mode (Recommended First Step)
SecRuleEngine DetectionOnlyLogs what the WAF would have blocked without actually blocking anything — essential first phase to identify and tune away false positives before enforcing actual blocking, since aggressive rule sets can otherwise block legitimate traffic.
Reviewing ModSecurity Logs
sudo tail -f /var/log/modsec_audit.logTuning False Positives
Once you identify legitimate traffic being flagged, add specific rule exclusions for that pattern rather than disabling broad rule categories — targeted exclusions maintain protection while accommodating your application's genuine legitimate traffic patterns.
Switching to Blocking Mode
SecRuleEngine OnOnly switch to active blocking after a genuine tuning period in detection-only mode, confirming false positives are adequately addressed.
Performance Considerations
WAF inspection adds some processing overhead per request — monitor performance impact (see How to Diagnose a Slow VPS: Complete Performance Checklist) after enabling, particularly under your actual production traffic load.
Common Errors
Legitimate requests blocked unexpectedly — check the audit log for the specific rule ID that triggered, then add a targeted exclusion for that rule in the context of the legitimate traffic pattern, rather than disabling the rule set broadly.
Continue Reading
- Understanding and Mitigating the OWASP Top 10 Vulnerabilities
- How to Rate Limit an API with Nginx
- How to Conduct a Security Audit of Your VPS
Browse more articles in Advanced Security & Compliance.
