BunkerWeb

BunkerWeb is an open-source web application firewall and reverse proxy designed to provide security for web services. Built on NGINX, it functions as a protective layer that can be deployed across various environments, including Linux, Docker, Swarm, and Kubernetes. It is used to secure web applications by managing traffic and filtering malicious requests before they reach the backend server, ensuring that services are secure by default upon deployment.

Users can manage the software through a command-line interface or an optional web user interface that eliminates the need for manual configuration files. The system supports a multisite mode, which is a crucial concept allowing a single instance or cluster to serve and protect multiple web applications using virtual hosts. Configuration is handled through a system of variables and settings, such as server names and security policies, to tailor the protection to specific use cases.

Key features

• Automated HTTPS certificate management via Let's Encrypt
• Integrated ModSecurity WAF with the OWASP Core Rule Set
• Bot protection using cookies, JavaScript, captcha, hCaptcha, or reCAPTCHA
• Automatic banning of clients based on HTTP status codes
• Connection and request limiting for clients
• IP blocking using external blacklists and DNSBL
• Implementation of HTTP security headers and TLS hardening
• Plugin system for extending core security capabilities

The software is licensed under AGPLv3 and is designed for DevOps and DevSecOps workflows. It integrates into existing infrastructure as a reverse proxy, providing a layer of defense that includes vulnerability scanning and anti-bot protections. The architecture allows for both simple single-site deployments and complex multi-site configurations, making it suitable for various hosting scales. By utilizing a variable-based configuration system, administrators can quickly enable or disable specific security modules to match their environment requirements.

BunkerWeb serves as a security gateway for administrators who require a configurable web application firewall for their hosting environments.