Creating App Protect Policy

NGINX App Protect default policy covers all the OWASP top 10 attack patterns enabling signature sets and BOT security protection out of the box.

See more: https://docs.nginx.com/nginx-app-protect-waf/configuration-guide/configuration/

Policy Resource

The Policy resource allows you to configure features like access control, rate-limiting, waf which you can add to your VirtualServer and VirtualServerRoute resources.

The WAF policy configures NGINX Plus to secure client requests using App Protect WAF policies.

For example, the following policy will enable the referenced

  • APPolicy = default/dataguard-alarm

  • and APLogConf = default/logconf

waf.yaml file

 1apiVersion: k8s.nginx.org/v1
 2kind: Policy
 3metadata:
 4  name: waf-policy
 5spec:
 6  waf:
 7    enable: true
 8    apPolicy: "default/dataguard-alarm"
 9    securityLogs:
10    - enable: true
11      apLogConf: "default/logconf"
12      logDest: "syslog:server=syslog-svc.default:514"

App Protect Policy (APPolicy)

You can define NGINX App Protect WAF policies for your VirtualServer, VirtualServerRoute by creating an APPolicy Custom Resource.

ap-dataguard-alarm-policy.yaml file

 1apiVersion: appprotect.f5.com/v1beta1
 2kind: APPolicy
 3metadata:
 4  name: dataguard-alarm
 5spec:
 6  policy:
 7    signature-requirements:
 8    - tag: Fruits
 9    signature-sets:
10    - name: jeruk_sigs
11      block: true
12      signatureSet:
13        filter:
14          tagValue: Fruits
15          tagFilter: eq
16    applicationLanguage: utf-8
17    blocking-settings:
18      violations:
19      - alarm: true
20        block: false
21        name: VIOL_DATA_GUARD
22    data-guard:
23      creditCardNumbers: true
24      enabled: true
25      enforcementMode: ignore-urls-in-list
26      enforcementUrls: []
27      lastCcnDigitsToExpose: 4
28      lastSsnDigitsToExpose: 4
29      maskData: true
30      usSocialSecurityNumbers: true
31    enforcementMode: blocking
32    name: dataguard-alarm
33    template:
34      name: POLICY_TEMPLATE_NGINX_BASE

User Defined Signature

You can define NGINX App Protect WAF User-Defined Signatures for your VirtualServer by creating an APUserSig Custom Resource.

In example below, we add user-signature that if there is “jeruk” string detected in the request then the request must be blocked.

This definition referenced in APPolicy CRD.

ap-jeruk-uds.yaml file

 1apiVersion: appprotect.f5.com/v1beta1
 2kind: APUserSig
 3metadata:
 4  name: jeruk
 5spec:
 6  signatures:
 7  - accuracy: medium
 8    attackType:
 9      name: Brute Force Attack
10    description: Medium accuracy user defined signature with tag (Fruits)
11    name: Jeruk_medium_acc
12    risk: medium
13    rule: content:"jeruk"; nocase;
14    signatureType: request
15    systems:
16    - name: Microsoft Windows
17    - name: Unix/Linux
18  tag: Fruits

Logging Resource Definition

syslog.yaml file

 1apiVersion: apps/v1
 2kind: Deployment
 3metadata:
 4  name: syslog
 5spec:
 6  replicas: 1
 7  selector:
 8    matchLabels:
 9      app: syslog
10  template:
11    metadata:
12      labels:
13        app: syslog
14    spec:
15      containers:
16        - name: syslog
17          image: balabit/syslog-ng:3.38.1
18          ports:
19            - containerPort: 514
20            - containerPort: 601
21---
22apiVersion: v1
23kind: Service
24metadata:
25  name: syslog-svc
26spec:
27  ports:
28    - port: 514
29      targetPort: 514
30      protocol: TCP
31  selector:
32    app: syslog

ap-logconf.yaml file

 1apiVersion: appprotect.f5.com/v1beta1
 2kind: APLogConf
 3metadata:
 4  name: logconf
 5spec:
 6  content:
 7    format: default
 8    max_message_size: 64k
 9    max_request_size: any
10  filter:
11    request_type: all

Deploy The Manifests

$ kubectl apply -f syslog.yaml
$ kubectl apply -f ap-jeruk-uds.yaml
$ kubectl apply -f ap-dataguard-alarm-policy.yaml
$ kubectl apply -f ap-logconf.yaml
$ kubectl apply -f waf.yaml