BunkerWeb — Open-Source Web Application Firewall

What it is

BunkerWeb is an open-source Web Application Firewall (WAF) built on NGINX. It functions as a reverse proxy that adds security layers including ModSecurity OWASP Core Rule Set, rate limiting, bot detection, country blocking, automatic HTTPS via Let's Encrypt, and custom security plugins. BunkerWeb protects any web application regardless of its tech stack.

DevOps engineers and development teams who need to secure web applications against common attacks (SQL injection, XSS, CSRF, DDoS) without purchasing commercial WAF products benefit most.

How it saves time or tokens

BunkerWeb bundles security features that typically require configuring multiple tools separately: NGINX for reverse proxy, ModSecurity for WAF rules, Certbot for TLS certificates, fail2ban for rate limiting, and custom scripts for bot detection. BunkerWeb provides all of these through a single configuration file or web UI. Deployment takes minutes with Docker, and the OWASP Core Rule Set provides baseline protection without writing custom rules.

How to use

1. Deploy BunkerWeb with Docker:

docker run -p 80:8080 -p 443:8443 \
  -e SERVER_NAME=app.example.com \
  -e REVERSE_PROXY_URL=/ \
  -e REVERSE_PROXY_HOST=http://backend:8080 \
  -e AUTO_LETS_ENCRYPT=yes \
  -e USE_MODSECURITY=yes \
  bunkerity/bunkerweb:latest

1. BunkerWeb sits in front of your application, handling TLS termination, WAF filtering, and reverse proxying.

1. Access the web UI at https://app.example.com:7000 to manage settings and view security logs.

Example

# docker-compose.yml with BunkerWeb protecting a web app
services:
  bunkerweb:
    image: bunkerity/bunkerweb:latest
    ports:
      - '80:8080'
      - '443:8443'
    environment:
      - SERVER_NAME=app.example.com
      - REVERSE_PROXY_URL=/
      - REVERSE_PROXY_HOST=http://myapp:3000
      - AUTO_LETS_ENCRYPT=yes
      - USE_MODSECURITY=yes
      - USE_BAD_BEHAVIOR=yes
      - LIMIT_REQ_RATE=10r/s
      - USE_COUNTRY=yes
      - BLACKLIST_COUNTRY=CN RU

  myapp:
    image: my-web-app:latest
    expose:
      - '3000'

Related on TokRepo

• Security Tools -- Web security and vulnerability scanning tools
• DevOps Tools -- Infrastructure and deployment tools

Common pitfalls

• ModSecurity rules can produce false positives, blocking legitimate requests. Start with the OWASP rules in detection-only mode, review logs, then switch to blocking mode after tuning.
• Rate limiting settings need calibration for your traffic patterns. Too aggressive settings block real users; too lenient settings do not stop attacks.
• BunkerWeb adds latency as a reverse proxy layer. For latency-sensitive applications, benchmark the overhead and adjust worker/connection settings.