Choose the protected target
Points the reverse proxy at the application being protected in the lab.
Bastion-WAF
Understand the request. Defend the application.
A hands-on study of request inspection, from established rules to a custom Python WAF.
Incoming requestInspectionDecision
ARCHITECTURE STUDY · ILLUSTRATIVE
Observe first. Enforce deliberately.
Configuration checked against the README and inspection code. These are documented settings, not measured protection results.
Tune the decision boundary
The documented default threshold is configurable. Tuning changes how the WAF responds to detected anomalies.
Separate detection from blocking
In the main inspection path, detection-only logs threshold violations; blocking returns HTTP 403 for them. Separate rate-limit and binary-header checks can still block in either mode.
A defensive rule needs context: the target, the threshold and the enforcement mode all affect its behavior.
Read the source ↗01 / The question
A firewall rule is easier to trust when you understand what it sees. What does request inspection actually do between a client and a vulnerable application?
02 / Project contribution
A multi-layer WAF laboratory: a custom Python reverse proxy with YAML signatures and JSONL blocked-request logs, alongside ModSecurity / OWASP CRS on Nginx and a DVWA target.
03 / Inside the implementation01 02 03
Observe the request path
Docker Compose connects the vulnerable target, open-source WAF and custom reverse proxy in a dedicated lab network.
Inspect and decide
The custom engine applies detection rules with a configurable anomaly threshold. Detection-only and blocking modes distinguish observation from enforcement in the main inspection path.
Compare the defenses
SQL injection and XSS examples support repeatable lab exercises. A documented dashboard and engineering report help compare the custom approach with established WAF systems.
04 / Scope & lessons
A defensive learning environment, not a production security product. No independent benchmark establishes throughput or detection completeness. Rate limiting and binary-asset header checks can still block in detection-only mode. DVWA is intentionally vulnerable and belongs in an isolated, authorized laboratory.