WAF Placement SOP: Edge vs Server
Deciding between Cloudflare WAF and a server-side WAF (ModSecurity, NAXSI). Pick by attack surface.
— Use edge WAF when: origin IP is hidden, you face volumetric/L7 floods, you want rules without touching the box.
— Use server WAF when: traffic must be inspected after TLS at origin, you run multi-tenant on one box, or compliance forbids third-party TLS termination.
— Verify edge can't be bypassed: lock origin firewall to Cloudflare IP ranges only. An edge WAF with an open origin is theater.
— Run both for layered defense: edge for volume, ModSecurity CRS for app-specific payloads.
— Confirm: curl the origin IP directly. If it answers, your edge rules are skippable.
Run this every time you front a site with a CDN.
Lockdown Ledger
@LockdownLedger
WAF Placement SOP: Edge vs Server
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.