WAFWikiIndependent WAF intelligence
中文

WAFWiki index

Search WAFWiki

Type at least 2 characters to search the full research library.

WAF installation guide

ModSecurity with NGINX and OWASP CRS Setup Guide

A practical ModSecurity and OWASP CRS deployment plan for NGINX reverse proxy environments, focused on tuning and validation.

Quick answer

How to use this ModSecurity with NGINX and OWASP CRS Setup Guide

Treat ModSecurity, the NGINX connector, and OWASP CRS as one versioned stack; establish clean-traffic baselines before increasing the CRS paranoia level or anomaly threshold.

Difficulty
Intermediate
Time
1-2 hours for a lab deployment
Updated
2026-07-26

Guide data

Difficulty
Intermediate
Time
1-2 hours for a lab deployment
Updated
2026-07-26
Use case
Useful when an NGINX team needs to evaluate ModSecurity, OWASP CRS, and open-source WAF tuning.

Prerequisites

  • NGINX reverse proxy experience.
  • A lab application with representative traffic.
  • A compatible ModSecurity connector or distribution path.
  • Time reserved for CRS tuning.

Deployment workflow

Version the engine, connector, and CRS together.

1

Select the connector and rule source

Confirm which ModSecurity connector and CRS version your deployment path supports. Version mismatches are a common source of confusing behavior.

  • Connector is documented for the target NGINX build.
  • CRS version is pinned.
  • Rule files are stored in source control or a repeatable package path.
2

Start in detection-only mode

Detection-only mode lets you collect rule hits without breaking normal workflows. This is the fastest way to learn where tuning is needed.

  • Audit logs are written.
  • False positives are visible.
  • Rule IDs can be traced back to CRS files.
3

Tune exclusions by evidence

Avoid broad rule disables. Prefer narrow exclusions tied to a path, parameter, method, or upstream service where the false positive is repeatable.

  • Each exclusion has a reason.
  • Clean requests stop triggering the rule.
  • Attack-like test traffic still triggers related controls.

Validation checklist

  • Replay common clean workflows and collect false-positive rule IDs.
  • Test safe SQLi and XSS payloads in a lab environment.
  • Measure upstream latency before and after enabling inspection.
  • Review audit log size and retention requirements.

Rollback planning

  • Keep a known-good NGINX config snapshot.
  • Be able to switch back to detection-only mode quickly.
  • Use staged config reloads instead of editing production rules manually.

Common mistakes

  • Enabling blocking mode before collecting enough clean traffic.
  • Disabling entire CRS categories because of one false positive.
  • Ignoring audit log volume until disk pressure appears.

Related WAF profiles

ModSecurityOWASP Core Rule Set

Lab verification

Commands to capture during the proof of concept

These checks are intentionally conservative. Replace hostnames and ports with your lab values, then save the outputs with the test notes.

1

Run the pinned ModSecurity and Coraza evidence matrix

scripts/run-waf-evidence-lab.sh

The final local run records 20/20 expected statuses under OWASP CRS 4.25.0 and writes CSV, JSON, and engine logs.

2

Review the ModSecurity subset

awk -F, 'NR == 1 || $1 == "modsecurity" { print }' docs/lab-evidence/waf-engine-comparison-2026-07-26-requests.csv

Six clean requests return 200 and four controlled SQLi/XSS requests return 403.

3

Check clean-traffic alert noise

rg '920350|Host header is a numeric IP address' docs/lab-evidence/waf-engine-comparison-2026-07-26-modsecurity.log

The localhost numeric Host warning is visible even though the selected clean requests were not blocked.

FAQ

What does the ModSecurity with NGINX and OWASP CRS Setup Guide workflow validate?

It validates connector loading, CRS rule execution, audit logging, a clean request path, and one controlled detection path while preserving an upstream bypass.

What must pass before ModSecurity with NGINX and OWASP CRS Setup Guide is used in production?

Production blocking should wait until representative request bodies, uploads, APIs, exclusions, audit-log volume, and rollback have been tested with the exact connector and CRS versions.

Sources