EN | FR | 🟡 WALL | sovereign application firewall

Pattern matched, ban applied in the kernel. No third-party service sits in the decision path.

sbxwaf is the Go web application firewall of SecuBox (package secubox-waf-ng, unit secubox-waf-ng, listening on 127.0.0.1:8085). All public traffic goes HAProxy (TLS 1.3) → sbxwaf → nginx. It inspects requests, blocks and bans, lures scanners, and feeds the intelligence layer (Actor-Intelligence). Its admin views are also assembled in the SOC.

request → sbxwaf → pattern → nft set (waf_ban / waf_ban6)
                              ↑
                       chain waf_drop, hook input, priority -100
                       ip saddr @waf_ban counter drop

The chain is the part that matters. A populated nft set that no rule references blocks nothing. sbxwaf therefore creates the chain and both rules at startup, preceded by a flush chain (add rule is not idempotent). Each element of the set carries a packet counter, which the end-of-ban re-evaluation reads (see below).

Open /waf/ (for instance https://waf.<box>/, LAN only). The default tab is the Overview; six more tabs are standalone pages in the common Aurora style (tiles, inline SVG charts, lists, no external library). They are read-only: banning and unbanning stay in the API (and are written to the audit log).

Every page accepts ?embed=1 (framed, one column) and ?demo=1 (announced demonstration data). A measure that is missing is shown as "—", never as zero.

Threats	Attackers

The common vocabulary (GET /api/v1/waf/enforcement/mode):

Automatic bans, each with an hourly circuit breaker and graduated durations:

Never banned: private or local addresses, ranges listed in --actor-ban-protegees, verified search engines. Details of the ladder and the activation procedure (PASSIVE_ONLY → SIMULATION → ACTIVE): Actor-Intelligence. A change is applied with systemctl restart secubox-waf-ng (never SIGHUP).

A robot is recognised by the proof the search engines document themselves: reverse DNS confirmed by forward DNS, in a closed list of domains (googlebot.com, google.com, search.msn.com, applebot.apple.com, crawl.baidu.com, yandex.*), strict sub-domain match. Result cached 24 h (1 h if negative). A spoofer (reverse written by him, forward not) stays banned; a DNS doubt is never an exemption. Bans already placed on verified robots are lifted at startup. The check needs the AppArmor profile to allow DNS, which the package reloads on upgrade.

Vhosts listed in anti_robots (/etc/secubox/waf/vhost_profiles.json, ticked with the Anti-robots checkbox of the Vhost panel) refuse search and harvesting robots with HTTP 403 (not 429: "come back later" would invite retries). It is a load decision, not threat detection: no ban, logged apart with action=robot. An empty list filters nobody. Three paths are always served: /robots.txt, /favicon.ico, /.well-known/. The LAN is exempt.

With --honeypot (off by default; example drop-in shipped in /usr/share/secubox/waf/honeypot.conf), unrouted host names and bait paths of real vhosts (/.env, /.git/…) are answered by a decoy. A decoy has no other purpose than detecting: any contact is banned, except the LAN and protected ranges.

Everything the decoy hands out carries a watermark: random bytes followed by an HMAC-SHA256 tag. Our marks are recognised anywhere without a table, nobody can forge one, and a fake key replayed against a real service earns a ban of at least 24 h. The secret lives in /etc/secubox/secrets/filigrane.

sbx-authwatch reads SSH, SMTP and IMAP (journal and files) and writes into the same ban set and the same threat log: campaign detection (keyed on the targeted account), non-existent account detection, 10 decoy ports that record and stay quiet. Per-service filters in /etc/secubox/authwatch/services.json; a service without a verified pattern stays "actif": false with the reason written down.

The service runs as the dedicated user secubox-waf (AppArmor enforce). The package re-applies the ownership at each start: a directory created by another component must not lock the WAF out of its own log.

A vhost unknown to sbxwaf gets a 421. The route table is /etc/secubox/waf/haproxy-routes.json, hot-reloaded. A package declares its route in its postinst — never by hand:

secubox-waf-route app.exemple.test 9080

The only sanctioned bypass is declarative: waf_bypass = true per vhost in /etc/secubox/haproxy.toml, honoured by haproxyctl.

SOC · Actor-Intelligence · ThreatMesh · Anti-Track · DPI-Vivant · Architecture · WAF-FR