Installing dynamic Wallarm module for NGINX from Debian/CentOS repositories¶

1. Open Wallarm Console → Settings → API tokens in the US Cloud or EU Cloud.
2. Find or create API token with the Deploy source role.
3. Copy this token.

4. Run the register-node script on a machine where you install the filtering node:

   US CloudEU Cloud

   sudo /usr/share/wallarm-common/register-node -t <TOKEN> --labels 'group=<GROUP>' -H us1.api.wallarm.com
   

   sudo /usr/share/wallarm-common/register-node -t <TOKEN> --labels 'group=<GROUP>'
   

   • <TOKEN> is the copied value of the API token with the Deploy role.
   • --labels 'group=<GROUP>' parameter puts your node to the <GROUP> node group (existing, or, if does not exist, it will be created). If you are installing filtering and postanalytics modules separately, it is recommended to put them into the same group.

1. Open Wallarm Console → Nodes in the US Cloud or EU Cloud.
2. Do one of the following:
   • Create the node of the Wallarm node type and copy the generated token.
   • Use existing node group - copy token using node's menu → Copy token.

3. Run the register-node script on a machine where you install the filtering node:

   US CloudEU Cloud

   sudo /usr/share/wallarm-common/register-node -t <TOKEN> -H us1.api.wallarm.com
   

   sudo /usr/share/wallarm-common/register-node -t <TOKEN>
   

• <TOKEN> is the copied value of the node token. If you are installing filtering and postanalytics modules separately, it is recommended to put them into the same group using the same node token.

1. Set an IP address for Wallarm to proxy legitimate traffic to. It can be an IP of an application instance, load balancer, or DNS name, etc., depending on your architectire.

   To do so, edit the proxy_pass value, e.g. Wallarm should send legitimate requests to http://10.80.0.5:

   server {
       listen 80;
       listen [::]:80 ipv6only=on;
   
       ...
   
       location / {
           proxy_pass http://10.80.0.5; 
           ...
       }
   }
   

2. For the Wallarm node to analyze the incoming traffic, set the wallarm_mode directive to monitoring:

   server {
       listen 80;
       listen [::]:80 ipv6only=on;
       wallarm_mode monitoring;
   
       ...
   }
   

   The monitoring mode is the recommended one for the first deployment and solution testing. Wallarm provides safe blocking and blocking modes as well, read more.

1. For the Wallarm node to accept mirrored traffic, set the following configuration:

   wallarm_force server_addr $http_x_server_addr;
   wallarm_force server_port $http_x_server_port;
   # Change 222.222.222.22 to the address of the mirroring server
   set_real_ip_from  222.222.222.22;
   real_ip_header    X-Forwarded-For;
   real_ip_recursive on;
   wallarm_force response_status 0;
   wallarm_force response_time 0;
   wallarm_force response_size 0;
   

   • The set_real_ip_from and real_ip_header directives are required to have Wallarm Console display the IP addresses of the attackers.
   • The wallarm_force_response_* directives are required to disable analysis of all requests except for copies received from the mirrored traffic.

2. For the Wallarm node to analyze the mirrored traffic, set the wallarm_mode directive to monitoring:

   server {
       listen 80;
       listen [::]:80 ipv6only=on;
       wallarm_mode monitoring;
   
       ...
   }
   

   Since malicious requests cannot be blocked, the only mode Wallarm accepts is monitoring. For in-line deployment, there are also safe blocking and blocking modes but even if you set the wallarm_mode directive to a value different from monitoring, the node continues to monitor traffic and only record malicious traffic (aside from the mode set to off).

Update targets of your load balancer to send traffic to the Wallarm instance. For details, please refer to the documentation on your load balancer.

Configure your web server to mirror incoming traffic to the Wallarm node. For configuration details, we recommend to refer to your web server documentation.

Inside the link, you will find the example configuration for the most popular of web servers (NGINX, Traefik, Envoy, Istio).