NGINX WAF in Roxy-WI 9.2
Last updated: · Applies to Roxy-WI 9.2 and later.
Install and operate ModSecurity for NGINX. The shared WAF guide covers the rule wizard, synchronization and apply states.
NGINX Web Application Firewall
Open NGINX → WAF to inspect server cards, install WAF, manage rules and view logs. NGINX runs ModSecurity as a module; saved rules take effect through a verified NGINX reload.
ModSecurity and CRS
Installation prepares ModSecurity and OWASP CRS. The rules directory is nginx_dir/waf/rules, usually /etc/nginx/waf/rules/. The entrypoint is nginx_dir/waf/waf.conf; the engine mode is stored in nginx_dir/waf/modsecurity.conf.
Enable the module and apply the configured mode
- Click Install WAF if needed, then inspect the card's diagnostics.
- Use Actions → Enable or Disable to change the ModSecurity integration. Roxy-WI validates the complete NGINX configuration and checks the reload result; a failed change triggers restoration.
- Select On, Off or DetectionOnly under Configured WAF mode. This saves the mode only on the selected server.
- Use Reload NGINX on the WAF page to apply saved changes, and check that the apply state is confirmed.
The module switch and the engine mode are separate: an enabled module with SecRuleEngine Off does not enforce rules. For protection on selected virtual hosts, review the inherited modsecurity setting and set the intended scope in the NGINX configuration.
Installation places modsecurity off; and the modsecurity_rules_file entrypoint in the main http block. To scope protection to selected virtual hosts, retain that inherited rules configuration and enable the intended server blocks with:
modsecurity on;Validate and reload through the normal NGINX configuration workflow after changing virtual-host scope. Check the effective parent configuration as well as the selected server block.
Rules, synchronization and troubleshooting
Use Manage rules to toggle Enabled, open Actions → View/Edit, or choose Add → Manual rule editor. Save validates and stores a file; Save and reload also applies it. Generated rules open in WAF Config Wizard, which requires Enterprise or higher.
Rule creation, editing, Include state and deletion synchronize automatically from a Master to its directly linked Slaves in the same group. Roxy-WI creates the matching catalog entries. Do not manually add a duplicate on each Slave. A conflict or failed target leaves changes pending; follow the synchronization recovery procedure.
For a failed validation, inspect the full NGINX configuration. If reload or recovery fails, inspect status and the error log before retrying. Use WAF events and audit logs to investigate requests; the apply-state reference explains what Roxy-WI has confirmed.