Skip to content

Deployment of the WAF node Docker image to Yandex.Cloud

This quick guide provides the steps to deploy the Docker image of the NGINX-based WAF node to the Yandex.Cloud platform using the Yandex Container Solution service.

The instructions limitations

These instructions do not cover the configuration of load balancing and WAF node autoscaling. If setting up these components yourself, we recommend that you read the appropriate Yandex.Cloud instructions.

Requirements

Options for the WAF node Docker container configuration

The WAF node configuration parameters should be passed to the deployed Docker container in one of the following ways:

  • In the environment variables. This option allows for the configuration of only basic WAF node parameters. Most directives cannot be configured through environment variables.

  • In the mounted configuration file. This option allows full WAF node configuration via any directives. With this configuration method, environment variables with the WAF node and Wallarm Cloud connection settings are also passed to the container.

Deploying the WAF node Docker container configured through environment variables

To deploy the containerized WAF node configured only through environment variables, you can use the Yandex.Cloud management console or CLI. In these instructions, Yandex.Cloud CLI is used.

  1. Set local environment variables with email and password used for authentication in the Wallarm Cloud:

    export DEPLOY_USER='<DEPLOY_USER>'
    export DEPLOY_PASSWORD='<DEPLOY_PASSWORD>'
    
    • <DEPLOY_USER>: email to the Deploy or Administrator user account in the Wallarm Console.
    • <DEPLOY_PASSWORD>: password to the Deploy or Administrator user account in the Wallarm Console.
  2. Create the instance with the running Docker container by using the yc compute instance create-with-container command:

    yc compute instance create-with-container \
        --name <INSTANCE_NAME> \
        --zone=<DEPLOYMENT_ZONE> \
        --public-ip \
        --container-image=wallarm/node:2.18.1-3 \
        --container-env=DEPLOY_USER=${DEPLOY_USER},DEPLOY_PASSWORD=${DEPLOY_PASSWORD},NGINX_BACKEND=<HOST_TO_PROTECT_WITH_WAF>
    
    yc compute instance create-with-container \
        --name <INSTANCE_NAME> \
        --zone=<DEPLOYMENT_ZONE> \
        --public-ip \
        --container-image=wallarm/node:2.18.1-3 \
        --container-env=DEPLOY_USER=${DEPLOY_USER},DEPLOY_PASSWORD=${DEPLOY_PASSWORD},NGINX_BACKEND=<HOST_TO_PROTECT_WITH_WAF>,WALLARM_API_HOST=us1.api.wallarm.com
    
    • --name: name of the instance, for example: wallarm-waf.
    • --zone: zone that will host the instance.
    • --public-ip: if this parameter is passed, the public IP address will be assigned to the instance.
    • --container-image: link to the Docker image of the WAF node.
    • --container-env: environment variables with the WAF node configuration (available variables are listed in the table below). Please note that it is not recommended to pass the values of DEPLOY_USER and DEPLOY_PASSWORD explicitly.

      Environment variable Description Required
      DEPLOY_USER Email to the Deploy or Administrator user account in the Wallarm Console. Yes
      DEPLOY_PASSWORD Password to the Deploy or Administrator user account in the Wallarm Console. Yes
      NGINX_BACKEND Domain or IP address of the resource to protect with WAF. Yes
      WALLARM_API_HOST Wallarm API server:
      • api.wallarm.com for the EU Cloud
      • us1.api.wallarm.com for the US Cloud
      By default: api.wallarm.com.
      No
      WALLARM_MODE WAF node mode:
      • block to block malicious requests
      • monitoring to analyze but not block requests
      • off to disable traffic analyzing and processing
      By default: monitoring.
      No
      TARANTOOL_MEMORY_GB Amount of memory allocated to Tarantool. The value can be an integer or a float (a dot . is a decimal separator). By default: 0.2 gygabytes. No
      WALLARM_ACL_ENABLE Enables the IP blocking functionality with default settings. The following values can be assigned to a variable:
      • true to enable the IP blocking functionality
      • false to disable the IP blocking functionality
      Default value (if the variable is not passed to the container) is false.
      To enable the IP blocking functionality with custom settings, you need to define appropriate NGINX directives and run the container mounting the configuration file with defined directives.

      Values on / enabled / ok / yes

      Since version 2.16.0-8 of the WAF node image, the values on / enabled / ok / yes assigned to this variable disable the IP blocking functionality. We recommend deploying the latest image version as described in the current document and passing the value true or false in this variable.

      No
      DEPLOY_FORCE Replaces an existing WAF node with a new one if an existing WAF node name matches the identifier of the container you are running. The following values can be assigned to a variable:
      • true to replace the WAF node
      • false to disable the replacement of the WAF node
      Default value (if the variable is not passed to the container) is false.
      The WAF node name always matches the identifier of the container you are running. WAF node replacement is helpful if the Docker container identifiers in your environment are static and you are trying to run another Docker container with the WAF node (for example, a container with a new version of the image). If in this case the variable value is false, the WAF node creation process will fail.
      No
    • All parameters of the yc compute instance create-with-container command are described in the Yandex.Cloud documentation.

  3. Open the Yandex.Cloud management console → Compute CloudVirtual machines and ensure the instance is displayed in the list.

  4. Test the WAF node operation.

Deploying the WAF node Docker container configured through the mounted file

To deploy the containerized WAF node configured through environment variables and mounted file, you should create the instance, locate the WAF node configuration file in this instance file system and run the Docker container in this instance. You can perform these steps via the Yandex.Cloud management console or Yandex.Cloud CLI. In these instructions, Yandex.Cloud CLI is used.

  1. Create the instance based on any operating system image following the Yandex.Cloud instructions. An example of the instance settings:

    Container instance setup

  2. Connect to the instance via SSH following the Yandex.Cloud instructions.

  3. Install the Docker packages in the instance following the instructions for an appropriate operating system.

  4. Set instance environment variables with email and password used for authentication in the Wallarm Cloud:

    export DEPLOY_USER='<DEPLOY_USER>'
    export DEPLOY_PASSWORD='<DEPLOY_PASSWORD>'
    
    • <DEPLOY_USER>: email to the Deploy or Administrator user account in the Wallarm Console.
    • <DEPLOY_PASSWORD>: password to the Deploy or Administrator user account in the Wallarm Console.
  5. In the instance, create the directory with the file default containing the WAF node configuration (for example, the directory can be named as configs). An example of the file with minimal settings:

    server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;
        #listen 443 ssl;
    
        server_name localhost;
    
        #ssl_certificate cert.pem;
        #ssl_certificate_key cert.key;
    
        root /usr/share/nginx/html;
    
        index index.html index.htm;
    
        wallarm_mode monitoring;
        # wallarm_instance 1;
        # wallarm_acl default;
    
        location / {
                proxy_pass http://example.com;
                include proxy_params;
        }
    }
    

    Set of WAF node directives that can be specified in the configuration file →

  6. Run the WAF node Docker container by using the docker run command with passed environment variables and mounted configuration file:

    docker run -d -e DEPLOY_USER=${DEPLOY_USER} -e DEPLOY_PASSWORD=${DEPLOY_PASSWORD} -v <INSTANCE_PATH_TO_CONFIG>:<CONTAINER_PATH_FOR_MOUNTING> -p 80:80 wallarm/node:2.18.1-3
    
    docker run -d -e DEPLOY_USER=${DEPLOY_USER} -e DEPLOY_PASSWORD=${DEPLOY_PASSWORD} -e WALLARM_API_HOST='us1.api.wallarm.com' -v <INSTANCE_PATH_TO_CONFIG>:<DIRECTORY_FOR_MOUNTING> -p 80:80 wallarm/node:2.18.1-3
    
    • <INSTANCE_PATH_TO_CONFIG>: path to the configuration file created in the previous step. For example, configs.
    • <DIRECTORY_FOR_MOUNTING>: directory of the container to mount the configuration file to. Configuration files can be mounted to the following container directories used by NGINX:

      • /etc/nginx/conf.d — common settings
      • /etc/nginx/sites-enabled — virtual host settings
      • /var/www/html — static files

      The WAF node directives should be described in the /etc/nginx/sites-enabled/default file.

    • -p: port the WAF node listens to. The value should be the same as the instance port.

    • -e: environment variables with the WAF node configuration (available variables are listed in the table below). Please note that it is not recommended to pass the values of DEPLOY_USER and DEPLOY_PASSWORD explicitly.

      Environment variable Description Required
      DEPLOY_USER Email to the Deploy or Administrator user account in the Wallarm Console. Yes
      DEPLOY_PASSWORD Password to the Deploy or Administrator user account in the Wallarm Console. Yes
      WALLARM_API_HOST Wallarm API server:
      • api.wallarm.com for the EU Cloud
      • us1.api.wallarm.com for the US Cloud
      By default: api.wallarm.com.
      No
      DEPLOY_FORCE Replaces an existing WAF node with a new one if an existing WAF node name matches the identifier of the container you are running. The following values can be assigned to a variable:
      • true to replace the WAF node
      • false to disable the replacement of the WAF node
      Default value (if the variable is not passed to the container) is false.
      The WAF node name always matches the identifier of the container you are running. WAF node replacement is helpful if the Docker container identifiers in your environment are static and you are trying to run another Docker container with the WAF node (for example, a container with a new version of the image). If in this case the variable value is false, the WAF node creation process will fail.
      No
  7. Test the WAF node operation.

Testing the WAF node operation

  1. Open the Yandex.Cloud management console → Compute CloudVirtual machines and copy the instance IP address from the Public IPv4 column.

    Settig up container instance

    If the IP address is empty, please ensure the instance is in the Running status.

  2. Send the request with test SQLI and XSS attacks to the copied address:

    curl http://<COPIED_IP>/?id='or+1=1--a-<script>prompt(1)</script>'
    
  3. Open the Wallarm Console → Events section in the EU Cloud or US Cloud and ensure attacks are displayed in the list.

    Attacks in UI

To view details on errors that occurred during the container deployment, please connect to the instance via SSH and review the container logs. If the instance is unavailable, please ensure required WAF node parameters with correct values are passed to the container.