The Web Application Firewall (WAF) inspects the requests that reach an HTTP or MCP Gateway tunnel and can log, challenge or block the ones that look malicious. You turn it on per tunnel and tune it in a separate WAF dashboard.
Before you start #
- An HTTP or MCP Gateway tunnel. Other tunnel types do not have the WAF. See HTTP / HTTPS and MCP Gateway.
- The WAF looks at web requests only. To limit who can connect at all, use Access control.
Turn the WAF on #
-
Open the WAF setting of the tunnel #
Open My Tunnels › HTTP (or MCP Gateway). In the Actions column of the tunnel, select the shield button. Its tooltip shows the current state: WAF: Active or WAF: Inactive. The WAF Setting dialog opens.
-
Switch WAF Enable on and save #
Turn on WAF Enable and select Save. The tunnel is not restarted, and the shield in the tunnel list turns green.
-
Copy the WAF Key #
The dialog shows the WAF Key of the tunnel with the middle masked. Copy copies the full key. You need it to sign in to the WAF dashboard.
Treat the WAF Key like a password. Anyone who has the key and the dashboard address can change the firewall of this tunnel.
-
Open the WAF Dashboard #
Under WAF Dashboard the dialog shows the address of the dashboard, which is on your tunnel's own domain. Select Open to open it in a new tab, paste the key into API Key and select Sign In.
The WAF Setting dialog #
| Item | What it does |
|---|---|
| WAF Enable | Turns the firewall on or off for this tunnel. |
| WAF Key | The key of this tunnel's firewall. It is read-only; Copy copies the full key to the clipboard. |
| WAF Dashboard | The address of the dashboard, with Open to open it in a new tab. |
| Learn how to use the Web Application Firewall | Opens the guide on the Localtonet blog. |
Saving this dialog is written to the tunnel's Activity Log as "WAF settings changed." Changes you make in the WAF dashboard are not listed there.
The WAF dashboard #
The dashboard shows the firewall of one tunnel. Its counters refresh every 5 seconds, and so does the event list while the Events tab is open. It has five tabs.
| Tab | What you find there |
|---|---|
| Overview | Counters for Total Requests, Blocked, Challenged, Logged and Allowed, the Block Rate, the Top Triggered Rules, the Top Blocked IPs and an IP Lookup. |
| Configuration | The sections Core Settings (see below), Rate Limiting, Request Size Limits, Protection Features, WebSocket Limits, Webhook Notifications, Custom Branding for the block page, and Path-Based Rate Limits. Save Changes applies them; Export and Import move a configuration as a JSON file. |
| Rules | The built-in rules with a checkbox per rule, and your own Custom Rules. |
| Events | Recent WAF Events: time, action, score, IP, country, host, method, URL, reason, the rules that matched and the processing time in milliseconds. You can filter by action (Block, Challenge, Log, Drop). |
| Security | Whitelist IPs / CIDR, Whitelist Paths, a list of blocked or allowed countries by two-letter country code, and IP / CIDR Ban Management. |
Core settings #
| Setting | Values | What it does |
|---|---|---|
| WAF Enabled | On or off | The same switch as WAF Enable in the tunnel list. Changing it here also changes the shield of the tunnel. |
| Mode | Prevention ("Active blocking") or Detection Only ("Log only") | In Detection Only, requests that match a rule are not blocked; they are only recorded under Events. Rate limits and IP bans still apply in that mode. In Prevention, requests that match are blocked or challenged. |
| Sensitivity | Low (1), Medium (2), Standard (3), High (4), Paranoid (5) | How easily a request counts as a threat. Low gives the fewest false positives, Paranoid is the strictest. The dashboard marks Standard as recommended. |
| Rate Limiting | Requests/Minute, Requests/Second, Domain Total/Min | The most requests one IP address may send per minute and per second, and the total requests allowed per domain per minute (0 = unlimited). Path-Based Rate Limits set custom rate limits for specific endpoints such as /login. |
Start in Detection mode. Check Mode right after you turn the WAF on. Run in Detection Only first, review the Events for false positives, then switch to Prevention.
Rules #
The Rules tab lists the built-in rules in one table and lets you switch single rules off when they do not fit your application. The rules cover, among others, SQL injection, NoSQL injection, cross-site scripting, path traversal, command injection, server-side request forgery, XML external entities, header injection, bot and scanner detection, request size limits and geo blocking. Select Save Rule Changes after you change a checkbox.
With Add Custom Rule you write a rule of your own:
| Field | Values |
|---|---|
| Match Field | URL, Query String, Body, Path, User-Agent, Referer, Method |
| Match Type | Contains, Equals, StartsWith, EndsWith, Regex |
| Action | Block, Log, Challenge |
| Score (1-10) | The weight of a match. The dashboard explains it as: 1-3 = low risk (log only), 4-6 = medium (challenge), 7-10 = high (block in Prevention mode). |
| Negate Match | Applies the rule to requests that do not match. |
Quick Templates add a ready-made custom rule with one click. A new custom rule or template is only added to the list on the page: the dashboard says "Click Save to apply."
What a blocked visitor sees #
| Situation | Response |
|---|---|
| The request is blocked | HTTP status 403 and a page with the heading Access Denied: "Your request has been blocked by the Web Application Firewall." The page shows the Block Reason, the Threat Score, a Ray ID and the Rules Triggered. |
| The request is challenged (Prevention mode only) | A browser check with the heading "Verifying you are human" before the page loads. |
| The rate limit is exceeded | HTTP status 429 and a page with the heading Too Many Requests. |
When a visitor reports a wrong block, ask for the block reason, the rules and the time shown on the page, and find the request under Events by its time, IP address and URL. The event list has no Ray ID column. Then switch off the rule that matched, add the visitor's address or the path to the whitelist on the Security tab, or lower the Sensitivity.
Turn the WAF off #
Select the shield button of the tunnel, switch WAF Enable off and select Save. The tooltip of the shield changes to WAF: Inactive.
Troubleshooting #
"Could not load WAF settings."
The dialog could not read the setting of the tunnel. Reload the page and try again.
"Wrong key." on the dashboard sign-in
The dashboard did not accept the key. Each tunnel has its own WAF Key. Open the WAF Setting dialog of the same tunnel and use Copy, which copies the full key; the key shown in the field is masked.
My own application is blocked
Set Mode to Detection Only so rule matches are only logged while you investigate. Find the blocked requests under Events, note the rules in the Rules column, and switch those rules off or whitelist the path.
The shield button is missing
Only HTTP and MCP Gateway tunnels have the WAF. TCP, UDP, TLS, File Server and proxy tunnels do not.
