Knowledge Base

What is Safeline and Why Should I Set Up My Own Cloudflare-Like Firewall?

Safeline is an open-source and customizable web application firewall (WAF) solution designed to protect your servers and web applications from various cyber threats. While commercial WAF solutions like Cloudflare are powerful, Safeline offers you full control, customization, and cost advantages. By setting up your own Safeline-based firewall, you get a solution that exactly meets your security needs, fits your budget, and is open to future developments.

Why Set Up Your Own Firewall?

• Full Control: You have complete control over your security policies, rules, and configurations.
• Customization: You can customize the firewall to suit the specific needs of your application.
• Cost Savings: You can achieve significant cost savings compared to commercial WAF solutions.
• Learning and Development: It's a great opportunity to learn and develop firewall technologies.
• Privacy: You know where your data is stored and how it is processed.

How Does Safeline Work?

Safeline is placed in front of a web server and inspects all incoming HTTP/HTTPS traffic. It detects and blocks potentially harmful requests (SQL injection, cross-site scripting (XSS), etc.). The basic working principles of Safeline are as follows:

1. Traffic Capture: Safeline captures all traffic coming to the web server.
2. Inspection: The captured traffic is compared against predefined rules and signatures.
3. Blocking/Allowing: Harmful requests that do not comply with the rules are blocked, and safe requests are forwarded to the web server.
4. Logging: All traffic and security events are logged.
5. Reporting: Security events and traffic statistics are reported.

Schematic Representation:

[Incoming Requests] --> [Safeline Firewall] --> [Web Server] --> [Database]

Safeline is usually configured as a reverse proxy, ensuring that all requests to the web server pass through Safeline first. This way, harmful requests are blocked before they reach the web server.

What are the Prerequisites for Safeline Installation?

The following prerequisites must be met to install Safeline:

• Server: You need a server. This can be a physical server, a virtual server (VPS), or a cloud-based server.
• Operating System: Your server must have an operating system installed. Linux (Ubuntu, Debian, CentOS) are commonly preferred operating systems.
• Web Server: You need a web server to host your web applications (Apache, Nginx, etc.).
• Python: Safeline is written in Python, so Python must be installed on your server.
• pip: You need pip to manage Python packages.
• Database (Optional): You can use a database to store security events and logs (MySQL, PostgreSQL, etc.).

Step-by-Step Installation Process (Ubuntu Example):

1. Update the Server:

   sudo apt update && sudo apt upgrade

2. Install Python and pip:

   sudo apt install python3 python3-pip

3. Install Safeline:

   pip3 install safeline

4. Configure the Web Server (Nginx Example):

   In your Nginx configuration file (usually /etc/nginx/sites-available/default), configure Safeline as a reverse proxy:

   
   server {
       listen 80;
       server_name example.com;
   
       location / {
           proxy_pass http://127.0.0.1:5000; # Address and port where Safeline is running
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
       }
   }
       

5. Start Safeline:

   safeline --host 0.0.0.0 --port 5000

How Can I Configure Safeline?

To configure Safeline, you need to edit the configuration file (usually safeline.conf). In this file, you can define security rules, blacklists, whitelists, and other settings.

Example Configuration File (safeline.conf):

[General]
log_level = INFO
log_file = /var/log/safeline.log

[Rules]
sql_injection = True
xss = True
csrf = True
file_inclusion = True

[Blacklist]
ip_addresses = 192.168.1.10, 10.0.0.5
user_agents = BadBot, EvilCrawler

[Whitelist]
ip_addresses = 127.0.0.1, 192.168.1.1

Configuration Parameters:

• log_level: Logging level (DEBUG, INFO, WARNING, ERROR, CRITICAL).
• log_file: Path to the log file.
• sql_injection: Protection against SQL injection attacks.
• xss: Protection against cross-site scripting attacks.
• csrf: Protection against cross-site request forgery attacks.
• file_inclusion: Protection against file inclusion attacks.
• ip_addresses (Blacklist): Blacklisted IP addresses.
• user_agents (Blacklist): Blacklisted user agents.
• ip_addresses (Whitelist): Whitelisted IP addresses.

Important Note: After editing the configuration file, you need to restart Safeline.

What are the Advantages and Disadvantages of Safeline?

Safeline has both advantages and disadvantages. By evaluating these advantages and disadvantages, you can determine whether it meets your security needs.

In summary: Safeline is an ideal solution for those looking for full control, customization, and cost savings. However, it is important to remember that it requires technical knowledge for installation and configuration, and that security rules must be kept up to date.

Real-Life Examples and Case Studies

Example 1: A Small E-Commerce Site

A small e-commerce site decided to use Safeline because it could not afford a commercial WAF solution. By installing Safeline, it provided protection against SQL injection and XSS attacks. It also protected server resources by blocking malicious bots. As a result, site security increased and cost savings were achieved.

Example 2: A Blog Site

A blog site was struggling with spam comments. Using Safeline, it created custom rules to block spam comments. It also increased site performance by blocking traffic from specific IP addresses. As a result, the blog site got rid of spam comments and provided a better user experience.

Safeline and Cloudflare: Comparison

Safeline and Cloudflare are two different approaches used to protect web applications. Safeline is an open-source and customizable WAF solution, while Cloudflare is a commercial WAF and CDN service.

Conclusion: Safeline is a suitable option for those seeking full control, customization, and cost savings. Cloudflare, on the other hand, may be more suitable for those who need features such as easy installation, CDN, and advanced DDoS protection.

How Can I Test My Safeline Firewall?

After installing and configuring your Safeline firewall, it is important to test it to ensure it is working properly. Here are some methods you can use to test your firewall:

1. SQL Injection Test:

   Submit inputs similar to SQL injection attacks into the input fields of your web application. For example, try entering a value like "' OR '1'='1" in a username field. If Safeline is working correctly, it should block or warn about such requests. Review the log files to ensure that such attack attempts are recorded.

2. XSS (Cross-Site Scripting) Test:

   Try adding JavaScript code to the input fields of your web application. For example, try adding code like "<script>alert('XSS');</script>" to a comment field. Safeline should filter or block such code. If you receive a warning message or the code is not executed, the XSS protection is working.

3. Malicious Bot Simulation:

   Send requests to your website using different user agents. By imitating the user agents used by some malicious bots, you can test whether Safeline blocks such bots. For example, you can simulate a BadBot using the command "curl -A "BadBot" http://example.com". Safeline should block user agents that you have defined in the blacklist.

4. Port Scanning Test with Nmap:

   Scan the open ports on your server using a port scanning tool like Nmap. The Safeline firewall should protect ports against unauthorized access and detect abnormal activity. You can scan the first 1000 ports with the command nmap -sS -p 1-1000 http://example.com. If there are unexpected open ports, check your firewall configuration.

5. Using OWASP ZAP:

   OWASP ZAP (Zed Attack Proxy) is a free and open-source tool that you can use to automatically detect various vulnerabilities in your web applications. You can simulate various attacks on your web application using ZAP and observe how Safeline responds to these attacks. ZAP is very effective in detecting common vulnerabilities such as XSS, SQL Injection, and CSRF.

Important Tips:

• Be careful when performing tests and take care not to damage your web application.
• Analyze test results regularly and adjust your firewall configuration accordingly.
• Regularly review firewall logs to detect potential attack attempts.

Common Mistakes and Solutions Related to Safeline

You may encounter some common mistakes during Safeline installation and configuration. Here are some of these mistakes and their solutions:

1. Error: Unable to start Safeline.

   Reason: This usually occurs due to missing dependencies, incorrect configuration, or port conflicts.

   Solution:

   • Ensure that all necessary Python packages are installed: pip3 install -r requirements.txt (if you have a requirements.txt file).
   • Check the configuration file (safeline.conf) and make sure it is configured correctly. Especially check parameters such as log_file, ip_addresses (blacklist/whitelist).
   • Make sure that the port Safeline is trying to use is not being used by another application. Try using a different port: safeline --host 0.0.0.0 --port 8080
   • Examine the log files to try to determine the cause of the error. Log files usually provide detailed information about the source of the error.
2. Error: Website is inaccessible (502 Bad Gateway error).

   Reason: This occurs because Safeline is not being correctly routed to the web server or the web server is not running.

   Solution:

   • Check the configuration file of your web server such as Nginx or Apache and make sure that Safeline is being routed to the correct address and port.
   • Make sure your web server is running. Try restarting the server: sudo systemctl restart nginx or sudo systemctl restart apache2
   • Make sure Safeline is running and can communicate with the web server.
   • Check your firewall settings. There may be a firewall rule that is blocking communication between Safeline and the web server.
3. Error: Security rules are not working as expected.

   Reason: This occurs due to incorrectly configured security rules or missing signatures.

   Solution:

   • Carefully check the security rules in the configuration file and make sure they are configured correctly. Especially make sure that rules such as SQL injection, XSS are enabled correctly.
   • Make sure the security rules are up to date. Regularly update the security signatures used by Safeline.
   • When creating custom security rules, perform tests to ensure that the rules are working correctly.
4. Error: Performance issues.

   Reason: This occurs due to high traffic, complex security rules, or insufficient server resources.

   Solution:

   • Optimize security rules. Disable unnecessary rules or create more efficient rules.
   • Increase server resources (CPU, RAM). You may consider switching to a more powerful server or increasing server resources.
   • Use caching. You can reduce the server load by caching the static content of your web application.
   • Apply optimization techniques to run Safeline more efficiently (for example, using a WSGI server such as Gunicorn or uWSGI).

Important Note: Examining log files during debugging is crucial. Log files will help you understand the cause of the error and find the correct solution.