Hello! Still discussing about WAF KEMP; now let’s continue to add setup some WAF rules on the SubVS of virtual services.

Kemp Web Application Firewall (WAF) services are natively integrated into the Kemp LoadMaster. This enables secure deployment of web applications, preventing Layer 7 attacks while maintaining core load balancing services and ensuring superior application delivery and security. WAF functionality directly augments the LoadMaster’s existing security features to create a layered defense for web applications – enabling safe, compliant, and productive use of published services.

WAF KEMP DEFAULT RULES

KEMP WAF has default rules that update daily.

This setting can be found at Web Application Firewall > Access Settings.

WAF KEMP CUSTOM RULES

You can also write and upload your own custom rules if required.

With the WAF-enabled LoadMaster, you can choose whether to use Kemp-provided rules, custom rules which can be uploaded, or a combination of both.

The writing in WAF KEMP has a similar syntax to ModSec writing rules.

The ModSecurity Reference Manual should be consulted in any cases where questions arise relating to the syntax of commands: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual

After writing some custom rules, you can upload them to KEMP through the following menu.

Web Application Firewall > Custom Rules > Browse > Add Ruleset

WAF KEMP DEMO

I’ve added some rules that block access from my device IP. The rules syntax is as the following:

SecRule REMOTE_ADDR "@ipMatch 125.164.9.70" \
id:99999,phase:1,t:none,log,deny,ctl:ruleEngine=off

If the rule is applied to the SubVs, my device will get an Access denied message from accessing the website.

Now go to Virtual Services > your 443 or 80 Virtual IP Address > your SubVSs > Modify

To enable the WAF rules, check the Enabled box on the WAF panel.

To apply the BLOCK-IP.conf WAF custom rule, just scroll down the rules on the Manage Rules column, check the BLOCK-IP rules, and apply them to the SubVs.

Here is the result before and after the rules, applied to the SubVs.

Before applying the rule

After applying the rule

You can also inspect the WAF Event log to see if the rule is read by the system.

2022-04-09T19:28:51+00:00 lb100 wafd: [client 125.164.9.70] ModSecurity: Access denied with code 403 (phase 1). IPmatch: “125.164.9.70” matched at REMOTE_ADDR. [file “/tmp/waf/6/BLOCK-IP.conf”] [line “2”] [id “99999”] [hostname “6.5 (subahmadcloud)”] [uri “/”] [unique_id “dce9c392-cd01-490f-adaf-755c64e3242a”] 2022-04-09T19:28:52+00:00 lb100 wafd: [client 125.164.9.70] ModSecurity: Access denied with code 403 (phase 1). IPmatch: “125.164.9.70” matched at REMOTE_ADDR. [file “/tmp/waf/6/BLOCK-IP.conf”] [line “2”] [id “99999”] [hostname “6.5 (subahmadcloud)”] [uri “/”] [unique_id “c19d2e9e-c2c5-4c35-a6fc-c63235f5eb35”] 2022-04-09T19:35:28+00:00 lb100 wafd: [client 125.164.9.70] ModSecurity: Access denied with code 403 (phase 1). IPmatch: “125.164.9.70” matched at REMOTE_ADDR. [file “/tmp/waf/6/BLOCK-IP.conf”] [line “2”] [id “99999”] [hostname “6.5 (subahmadcloud)”] [uri “/”] [unique_id “87c30379-753d-4632-8e86-48256ce6dc44”] 2022-04-09T19:35:29+00:00 lb100 wafd: [client 125.164.9.70] ModSecurity: Access denied with code 403 (phase 1). IPmatch: “125.164.9.70” matched at REMOTE_ADDR. [file “/tmp/waf/6/BLOCK-IP.conf”] [line “2”] [id “99999”] [hostname “6.5 (subahmadcloud)”] [uri “/”] [unique_id “a507ea93-eec2-41d1-9532-4978db0f06c7”]

CONCLUSION

Though it is a long work process, it is still worth starting with. If you miss part 1, please read it here.

The post Set Up WAF KEMP in ServerStadium Part 2 appeared first on ServerStadium.

WAF or Web Application Firewall helps protect web applications by filtering and monitoring HTTP/s traffic between a web application and the internet. The typical protection of WAF can provide, such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection.

The original product of KEMP Technologies can be found at https://kemptechnologies.com/

Licensing

KEMP VLM has two types of licenses, the paid one and the trial one.

You can go with the paid license for a production environment since it will unlock all KEMP VLM’s features.

However, we will go with the trial license in this section since we don’t need to go to a production environment yet.

Please register your account Here – Start Free Trial to get your free trial license.

Create Virtual Machine

First, you must deploy a Virtual Machine with KEMP VLM as a template image.

Access the KEMP management UI and set the new password for the administrator. Please set the password so that it will fulfill the complexity requirements.

The management interface should be like in this picture.

Additional Private IP + Public IP

You need to create additional private IP and public IP since the default private IP and public IP will be used as the management interface. Please follow the steps below to add new IP to an existing VM.

• Navigate to KEMP VM, click Public & Private IP
• Click Acquire New Private IP
• Click Acquire new Public IP, and attach the public IP to the new Private IP
• Your newly acquired IP should be like in the following picture

Rules & Checking

Content Rules

Content Rules are needed because if two different websites use the same 1 IP on the SubVirtul Real server (SubVR), only the website in the last order can be accessed.

Example:

Assigned the content rules to each SubVS

Virtual Services

Virtual Services will contain an HTTP/s service held by the backend webserver.

• On the left pane, click add new
• Specify the parameter below:

Example of virtual service configuration

• Save the Virtual Services value by clicking the Add this Virtual Service button at the right pane.

Adding and Modifying the SubVS

This SubVS will contain each virtual host configuration of the domain.

• Navigate to Virtual Services > View/Modify Services
• In the SubVSs row, click Add New button on the right of the pane
• For HTTP SubVs, we only need to set a nickname and add HTTP as a Real Server protocol
• Real Server will be the webserver behind the KEMP VLM

Example of HTTP SubVs and Real Server configuration

HTTPS Virtual Service

Assuming you have an SSL certificate and want access to your domain through an HTTPS connection.

First, Please create Virtual Services with 443 as a listening port.

You may set the Real Server with an 80 port since the SSL termination will be on the KEMP side.

Certificate & Security

Import the SSL certificate of your domain to KEMP LoadMaster.

Then assign the available certificate to 443 Virtual Services

Conclusion

Almost there! We will continue to add some WAF rules in the next part. Please visit article part 2!

The post Set Up WAF KEMP in ServerStadium Part 1 appeared first on ServerStadium.

Load Balancer is a single point entry to distribute the load between servers and can act as a proxy for the backend server behind it. ServerStadium load balancer implements a TCP-level with three policies: round-robin, Least connection, and Source IP.

• Round-robin load balancing: Client requests are forwarded to each server in turn
• Least connection load balancing: Client requests are distributed to the backend server with the least number of active connections at the time the client request is received.
• Source IP load balancing: This type of load balancing uses an algorithm that takes the source and destination IP addresses of the client and server to generate a unique hash key. This key is used to allocate the client to a particular server. As the key can be regenerated if the session is broken, this load-balancing method can ensure that the client is directed to the same server previously used.

Creating a Load Balancer

1. Login to your ServerStadium management portal
2. Navigate to Networking > Load Balancer
3. Click Add New Load Balancer
4. Input the required value displayed by the dialog box

• • Location: Jakarta
  • Load Balancer Name: the name of your load balancer rule
  • Algorithm: Choose your desired load balancer algorithm (round-robin, least connection, and Source IP Hash)
  • Public Port: Input your public-facing port
  • Private Port: Input your private port (the listened port at your instances)
  • Public IP for LoadBalancer: Choose Acquire Automatically if you don’t have any Public IP or want to acquire new Public IP, otherwise please choose the available Public IP in your load balancer

5. Click Add Load Balancer and wait until the provisioning is completed

Assigning Backend Server

1. Click Configure on the newly created Load Balancer
2. Click Assign new VM, and choose the specific VMs as the backend servers for the load balancer
3. The final result should be like the below pictures

4. No need to assign IP Public to the VM, because you only need the loadbalancer IP Public in front of your servers.

Testing the Load Balancer

Let’s test the load balancer to see if this works. We are gonna use the round-robin as load balancer algorithm. The expected result is, the traffic will forwarded to one web server and another, everytime request been made.

Here, we test using a curl command from command line. The syntax will be like curl http://<load balancer IP>:8080/ 
curl http://202.43.248.249:8080/

Conclusion

If you plan deploy multiple VMs as Web workers or another app that required multiple computing machines, best to deploy the loadbalancer to distribute the load balancely.

To get more tips and tutorial article you can check on ServerStadiums’s Knowledge base. Or even better, you can sign up now for free in ServerStadium to try our dashboard and feature.

The post ServerStadium Load Balancer, Solution to Distribute Load Equally appeared first on ServerStadium.

As your server is growing and your visitor/user is increasing, you will need a good load-balancing system. You may know some popular load balancing systems such as Nginx, HAProxy, Balance, Pen, etc. However, you will need experience in setting up these systems. Of course, it is not easy to set up.

Don’t worry; ServerStadium can do the magic.
Once you log into the control panel https://cp.serverstadium.com, there is a menu on the left side of the dashboard. You can click “Networking” and then choose “Load Balance”

How to Set Your Load Balancing System Up in ServerStadium

Done; you have your Loadbalance system on your VM in just 7 steps!

The post Load Balancing in ServerStadium appeared first on ServerStadium.