Upgrading Wallarm NGINX modules¶

These instructions describe the steps to upgrade the Wallarm NGINX modules 4.x installed from the individual packages to version 6.x. These are the modules installed in accordance with one of the following instructions:

• Individual packages for NGINX stable

• Individual packages for NGINX Plus

• Individual packages for distribution-provided NGINX

To upgrade the end‑of‑life node (3.6 or lower), please use the different instructions.

Requirements¶

• Access to the account with the Administrator role in Wallarm Console for the US Cloud or EU Cloud.

• Access to https://meganode.wallarm.com to download all-in-one Wallarm installer. Ensure the access is not blocked by a firewall.

• Access to https://us1.api.wallarm.com for working with US Wallarm Cloud or to https://api.wallarm.com for working with EU Wallarm Cloud. If access can be configured only via the proxy server, then use the instructions.

• Executing all commands as a superuser (e.g. root).

• Access to the IP addresses below for downloading updates to attack detection rules and API specifications, as well as retrieving precise IPs for your allowlisted, denylisted, or graylisted countries, regions, or data centers.

  US CloudEU Cloud

  34.96.64.17
  34.110.183.149
  35.235.66.155
  34.102.90.100
  34.94.156.115
  35.235.115.105
  

  34.160.38.183
  34.144.227.90
  34.90.110.226
  

Upgrade procedure¶

• If filtering node and postanalytics modules are installed on the same server, then follow the instructions below to upgrade all.

  You will need to run a node of the newer version using all-in-one installer on a clean machine, test that it works well and stop the previous one and configure traffic to flow through the new machine instead of the previous one.

• If filtering node and postanalytics modules are installed on different servers, first upgrade the postanalytics module and then the filtering module following these instructions.

Step 1: Prepare clean machine¶

When upgrading modules with all-in-one installer, you cannot upgrade an old package installation - instead you need to use a clean machine. Thus, as step 1, prepare a machine with one of the supported OS:

• Debian 10, 11 and 12.x

• Ubuntu LTS 18.04, 20.04, 22.04

• CentOS 7, 8 Stream, 9 Stream

• Alma/Rocky Linux 9

• RHEL 8.x

• RHEL 9.x

• Oracle Linux 8.x

• Oracle Linux 9.x

• Redox

• SuSe Linux

• Others (the list is constantly widening, contact Wallarm support team to check if your OS is in the list)

Using new clean machine will lead to that at some moment you will have both old and new node, which is good: you can test the new one working properly without stopping the old one.

Step 2: Install latest NGINX and dependencies¶

Install the latest NGINX version of:

• NGINX stable (the latest supported version is v1.28.0) - see how to install it in the NGINX documentation.

• NGINX Mainline (the latest supported version is v1.27.5) - see how to install it in the NGINX documentation.

• NGINX Plus (the latest supported version is NGINX Plus R33) - see how to install it in the NGINX documentation.

• Distribution-Provided NGINX - to install, use the following commands:

  DebianUbuntuCentOSAlmaLinux, Rocky Linux or Oracle Linux 8.xRHEL 8.x

  sudo apt update 
  sudo apt -y install --no-install-recommends nginx
  

  sudo apt-get update
  sudo apt-get install nginx
  

  sudo yum -y update 
  sudo yum install -y nginx
  

  sudo yum -y update 
  sudo yum install -y nginx
  

  sudo yum -y update 
  sudo yum install -y nginx
  

Step 3: Prepare Wallarm token¶

To install node, you will need a Wallarm token of the appropriate type. To prepare a token:

Step 4: Download all-in-one Wallarm installer¶

Wallarm suggests all-in-one installations for the following processors:

• x86_64

• ARM64 (beta)

To download all-in-one Wallarm installation script, execute the command:

curl -O https://meganode.wallarm.com/6.3/wallarm-6.3.0.x86_64-glibc.sh

curl -O https://meganode.wallarm.com/6.3/wallarm-6.3.0.aarch64-glibc.sh

Step 5: Run all-in-one Wallarm installer¶

Filtering node and postanalytics on the same server¶

1. Run downloaded script:

   API tokenNode token

   # If using the x86_64 version:
   sudo env WALLARM_LABELS='group=<GROUP>' sh wallarm-6.3.0.x86_64-glibc.sh
   
   # If using the ARM64 version:
   sudo env WALLARM_LABELS='group=<GROUP>' sh wallarm-6.3.0.aarch64-glibc.sh
   

   The WALLARM_LABELS variable sets group into which the node will be added (used for logical grouping of nodes in the Wallarm Console UI).

   # If using the x86_64 version:
   sudo sh wallarm-6.3.0.x86_64-glibc.sh
   
   # If using the ARM64 version:
   sudo sh wallarm-6.3.0.aarch64-glibc.sh
   

2. Select US Cloud or EU Cloud.

3. Enter Wallarm token.

Filtering node and postanalytics on different servers¶

1. Upgrade postanalytics module following these instructions.

2. Upgrade filtering node:

   API tokenNode token

   # If using the x86_64 version:
   sudo env WALLARM_LABELS='group=<GROUP>' sh wallarm-6.3.0.x86_64-glibc.sh filtering
   
   # If using the ARM64 version:
   sudo env WALLARM_LABELS='group=<GROUP>' sh wallarm-6.3.0.aarch64-glibc.sh filtering
   

   The WALLARM_LABELS variable sets group into which the node will be added (used for logical grouping of nodes in the Wallarm Console UI).

   # If using the x86_64 version:
   sudo sh wallarm-6.3.0.x86_64-glibc.sh filtering
   
   # If using the ARM64 version:
   sudo sh wallarm-6.3.0.aarch64-glibc.sh filtering
   

Step 6: Transfer NGINX and postanalytics configuration from old node machine to new¶

Migrate the node-related NGINX and postanalytics configurations from the old machine to the new one by copying the necessary directives or files:

• /etc/nginx/conf.d/default.conf or /etc/nginx/nginx.conf with NGINX settings for the http level

  If the filtering and postanalytics nodes are on different servers, in the http block of /etc/nginx/nginx.conf on the filtering node machine, rename wallarm_tarantool_upstream to wallarm_wstore_upstream.

• /etc/nginx/sites-available/default with NGINX and Wallarm settings for traffic routing

• /etc/nginx/conf.d/wallarm-status.conf → copy to /etc/nginx/wallarm-status.conf on the new machine

  Detailed description is available within the link.

• /etc/wallarm/node.yaml → copy to /opt/wallarm/etc/wallarm/node.yaml on the new machine

  If using a custom host and port on a separate postanalytics server, rename the tarantool section to wstore in the copied file on the postanalytics node machine.

Step 7: Restart NGINX¶

Restart NGINX using the following command:

sudo systemctl restart nginx

Step 8: Test Wallarm node operation¶

To test the new node operation:

1. Send the request with test SQLI and XSS attacks to the protected resource address:

   curl http://localhost/?id='or+1=1--a-<script>prompt(1)</script>'
   

2. Open the Wallarm Console → Attacks section in the US Cloud or EU Cloud and ensure attacks are displayed in the list.

3. As soon as your Cloud stored data (rules, IP lists) is synchronized to the new node, perform some test attacks to make sure your rules work as expected.

Step 9: Configure sending traffic to Wallarm node¶

Update targets of your load balancer to send traffic to the Wallarm instance. For details, please refer to the documentation on your load balancer.

Before full redirecting of the traffic to the new node, it is recommended to first redirect it partially and check that the new node behaves as expected.

Step 10: Remove old node¶

1. Delete old node in Wallarm Console → Nodes by selecting your node and clicking Delete.

2. Confirm the action.

   When the node is deleted from Cloud, it will stop filtration of requests to your applications. Deleting the filtering node cannot be undone. The node will be deleted from the list of nodes permanently.

3. Delete machine with the old node or just clean it from Wallarm node components:

   DebianUbuntuCentOS or Amazon Linux 2.0.2021x and lowerAlmaLinux, Rocky Linux or Oracle Linux 8.xRHEL 8.x

   sudo apt remove wallarm-node nginx-module-wallarm
   

   sudo apt remove wallarm-node nginx-module-wallarm
   

   sudo yum remove wallarm-node nginx-module-wallarm
   

   sudo yum remove wallarm-node nginx-module-wallarm
   

   sudo yum remove wallarm-node nginx-module-wallarm
   

Was this page helpful?

How can we improve this article? (Optional)

Information is unclear or confusing

Insufficient information

Outdated or incorrect information

0/240

Send